{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "ca-certificates", "libperl5.34", "perl", "perl-base", "perl-modules-5.34", "xxd" ] } }, "diff": { "deb": [ { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20240203~22.04.1", "version": "20240203~22.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260601~22.04.1", "version": "20260601~22.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2156786 ], "changes": [ { "cves": [], "log": [ "", " * Update Mozilla certificate authority bundle to version 2.86", " (LP: #2156786)", " The following certificate authority was added (+):", " + e-Szigno TLS Root CA 2023", " The following certificate authorities were removed (-):", " - QuoVadis Root CA 2", " - QuoVadis Root CA 3", " - DigiCert Assured ID Root CA", " - DigiCert Global Root CA", " - DigiCert High Assurance EV Root CA", " - SwissSign Gold CA - G2", " - SecureTrust CA", " - Secure Global CA", " - COMODO Certification Authority", " - Certigna", " - certSIGN ROOT CA", " - AffirmTrust Commercial", " - AffirmTrust Networking", " - AffirmTrust Premium", " - AffirmTrust Premium ECC", " - TeliaSonera Root CA v1", " - Entrust Root Certification Authority - G2", " - Entrust Root Certification Authority - EC1", " - Trustwave Global Certification Authority", " - Trustwave Global ECC P256 Certification Authority", " - Trustwave Global ECC P384 Certification Authority", " - GLOBALTRUST 2020", " - GTS Root R2", " - FIRMAPROFESIONAL CA ROOT-A WEB", " The following certificate authority was renamed (~):", " ~ \"OISTE Server Root RSA G1\" (removed leading space)", " * Update Mozilla certificate authority bundle to version 2.82", " The following certificate authorities were added (+):", " + TrustAsia TLS ECC Root CA", " + TrustAsia TLS RSA Root CA", " + SwissSign RSA TLS Root CA 2022 - 1", " + OISTE Server Root ECC G1", " + OISTE Server Root RSA G1", " The following certificate authorities were removed (-):", " - GlobalSign Root CA", " - Entrust.net Premium 2048 Secure Server CA", " - Baltimore CyberTrust Root (closes: #1121936)", " - Comodo AAA Services root", " - XRamp Global CA Root", " - Go Daddy Class 2 CA", " - Starfield Class 2 CA", " - CommScope Public Trust ECC Root-01", " - CommScope Public Trust ECC Root-02", " - CommScope Public Trust RSA Root-01", " - CommScope Public Trust RSA Root-02", " * Update Mozilla certificate authority bundle to version 2.74.", " The following certificate authorities were added (+):", " + D-TRUST BR Root CA 2 2023", " + D-TRUST EV Root CA 2 2023", " The following certificate authorities were removed (-):", " - Entrust Root Certification Authority - G4", " - SecureSign RootCA11", " - Security Communication RootCA3", " - SwissSign Silver CA - G2", " * Update Mozilla certificate authority bundle to version 2.70.", " The following certificate authorities were added (+):", " + Telekom Security TLS ECC Root 2020", " + Telekom Security TLS RSA Root 2023", " + FIRMAPROFESIONAL CA ROOT-A WEB", " + TWCA CYBER Root CA", " + SecureSign Root CA12", " + SecureSign Root CA14", " + SecureSign Root CA15", " The following certificate authorities were removed (-):", " - Security Communication Root CA (closes: #1063093)", "" ], "package": "ca-certificates", "version": "20260601~22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2156786 ], "author": "Marc Deslauriers ", "date": "Mon, 15 Jun 2026 12:17:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.5", "version": "5.34.0-3ubuntu1.5" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" }, { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: accept quantifier limit error", " on 32-bit architectures where the quantifier limit catches the", " oversized pattern before the overflow guard", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.7", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Mon, 23 Jun 2026 11:11:00 +0300" }, { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " targets against absolute paths and directory traversal in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-42496", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer", " overflow via quantified fixed-string regex in t/re/pat_psycho.t", " - debian/patches/CVE-2026-8376_2.patch: add overflow check before", " fixed-string buffer allocation in regcomp.c / regcomp_study.c", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.6", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Fri, 12 Jun 2026 16:42:26 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.5", "version": "5.34.0-3ubuntu1.5" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" }, { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: accept quantifier limit error", " on 32-bit architectures where the quantifier limit catches the", " oversized pattern before the overflow guard", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.7", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Mon, 23 Jun 2026 11:11:00 +0300" }, { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " targets against absolute paths and directory traversal in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-42496", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer", " overflow via quantified fixed-string regex in t/re/pat_psycho.t", " - debian/patches/CVE-2026-8376_2.patch: add overflow check before", " fixed-string buffer allocation in regcomp.c / regcomp_study.c", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.6", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Fri, 12 Jun 2026 16:42:26 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.5", "version": "5.34.0-3ubuntu1.5" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" }, { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: accept quantifier limit error", " on 32-bit architectures where the quantifier limit catches the", " oversized pattern before the overflow guard", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.7", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Mon, 23 Jun 2026 11:11:00 +0300" }, { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " targets against absolute paths and directory traversal in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-42496", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer", " overflow via quantified fixed-string regex in t/re/pat_psycho.t", " - debian/patches/CVE-2026-8376_2.patch: add overflow check before", " fixed-string buffer allocation in regcomp.c / regcomp_study.c", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.6", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Fri, 12 Jun 2026 16:42:26 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.5", "version": "5.34.0-3ubuntu1.5" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" }, { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: accept quantifier limit error", " on 32-bit architectures where the quantifier limit catches the", " oversized pattern before the overflow guard", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.7", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Mon, 23 Jun 2026 11:11:00 +0300" }, { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " targets against absolute paths and directory traversal in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-42496", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer", " overflow via quantified fixed-string regex in t/re/pat_psycho.t", " - debian/patches/CVE-2026-8376_2.patch: add overflow check before", " fixed-string buffer allocation in regcomp.c / regcomp_study.c", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.6", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Fri, 12 Jun 2026 16:42:26 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "xxd", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.31", "version": "2:8.2.3995-1ubuntu2.31" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.32", "version": "2:8.2.3995-1ubuntu2.32" }, "cves": [ { "cve": "CVE-2026-47162", "url": "https://ubuntu.com/security/CVE-2026-47162", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-47167", "url": "https://ubuntu.com/security/CVE-2026-47167", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52858", "url": "https://ubuntu.com/security/CVE-2026-52858", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52860", "url": "https://ubuntu.com/security/CVE-2026-52860", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52859", "url": "https://ubuntu.com/security/CVE-2026-52859", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-47162", "url": "https://ubuntu.com/security/CVE-2026-47162", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-47167", "url": "https://ubuntu.com/security/CVE-2026-47167", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52858", "url": "https://ubuntu.com/security/CVE-2026-52858", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52860", "url": "https://ubuntu.com/security/CVE-2026-52860", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52859", "url": "https://ubuntu.com/security/CVE-2026-52859", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Code injection via NetrwBookHistSave().", " - debian/patches/CVE-2026-47162.patch: Properly quote the directory name", " in runtime/autoload/netrw.vim.", " - CVE-2026-47162", " * SECURITY UPDATE: Code Injection in cucumber filetype plugin.", " - debian/patches/CVE-2026-47167.patch: Use rubys Regexp.new() in", " runtime/ftplugin/cucumber.vim.", " - CVE-2026-47167", " * SECURITY UPDATE: Code execution with python3complete.", " - debian/patches/CVE-2026-52858.patch: Disable execution of import/from", " statements in runtime/autoload/python3complete.vim and", " ../pythoncomplete.vim", " - debian/patches/CVE-2026-52860.patch: Strip default expressions and", " annotations in runtime/autoload/python3complete.vim and", " ../pythoncomplete.vim", " - CVE-2026-52858", " - CVE-2026-52860", " * SECURITY UPDATE: Out-of-bounds read in update_snapshot().", " - debian/patches/CVE-2026-52859.patch: Bound loop in handle_pushline() in", " src/terminal.c.", " - CVE-2026-52859", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.32", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 15 Jun 2026 16:18:48 -0600" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20260614 to 20260624", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260614", "to_serial": "20260624", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }