{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "libc-bin", "libc6", "libperl5.34", "libpython3.10-minimal", "libpython3.10-stdlib", "perl", "perl-base", "perl-modules-5.34", "python3.10", "python3.10-minimal" ] } }, "diff": { "deb": [ { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.15", "version": "2.35-0ubuntu3.15" }, "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.35-0ubuntu3.15", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:20:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.15", "version": "2.35-0ubuntu3.15" }, "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.35-0ubuntu3.15", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:20:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10-minimal", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10-stdlib", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.10", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.10-minimal", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20260904 to 20260909", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260904", "to_serial": "20260909", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }