Ubuntu issues security notices for KissFFT, libEBML, Beets and Apache regression, plus 24.04.5 LTS point release
On 2026-09-10, Ubuntu published new fixes for KissFFT (USN-8745-1), libEBML (USN-8746-1), and Beets (USN-8747-1), and reissued Apache HTTP Server fixes as USN-8571-2 to correct a startup regression with HTTP/2 proxying introduced by USN-8571-1. The Ubuntu 24.04.5 LTS point release refreshes installation media so new installs include accumulated security patches, reducing the post-install update…
Ubuntu published four security notices fixing KissFFT flaws that could cause denial of service or arbitrary code execution, a libEBML buffer overflow, Beets HTML/JavaScript injection, and an Apache HTTP Server startup regression, while the Ubuntu 24.04.5 LTS…
On 2026-09-10, Ubuntu released three new security notices and a regression fix. USN-8745-1 fixes two KissFFT flaws, CVE-2025-34297 (large Fourier transform sizes mishandled on 32-bit architectures) and CVE-2026-41445 (multidimensional Fourier transform sizes); either issue could crash KissFFT, resulting in denial of service or arbitrary code execution. USN-8746-1 fixes incorrect handling of certain read and write operations in libEBML, which could allow a buffer overflow resulting in denial of service; no CVE id was given for this flaw. USN-8747-1 fixes a Beets web interface vulnerability in which untrusted media metadata was incorrectly escaped, letting an attacker inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser; no CVE id was given. USN-8571-2 fixes a regression introduced by USN-8571-1: the earlier fix was incomplete due to a missing library symbol, causing Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. The original USN-8571-1 advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability fixed in multiple Apache modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab, and Dawit Jeong. Separately, Canonical released Ubuntu 24.04.5 LTS, the fifth maintenance point release of the 24.04 'Noble Numbat' series, bundling accumulated security corrections and high-severity bug fixes into new installation media for desktop, server, and nine flavors including Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio, and Edubuntu. According to Cyber Security News, the Hardware Enablement kernel stack moves to Linux 7.0 with Mesa 26.2 (pulled from Ubuntu 26.04 LTS) while the GA kernel remains on the 6.8 series, and Livepatch covers the 7.0 HWE kernel on x86-64; Help Net Security's coverage of the release names no CVEs or bug IDs. Existing 24.04 systems receive the same fixes through regular updates, and 22.04 LTS users get them via the automatic upgrade path at no cost. Support timelines still count from the original 24.04 launch: five years for Desktop/Server/Cloud/Core and three for flavors (standard support through May 2029), extendable with Expanded Security Maintenance to 2034.
- USN-8745-1 fixes two KissFFT flaws, CVE-2025-34297 and CVE-2026-41445, which could cause denial of service or arbitrary code execution; the first involves large Fourier transform sizes on 32-bit architectures, the second multidimensional…
- USN-8746-1 fixes a libEBML buffer overflow caused by incorrect handling of certain read and write operations, resulting in denial of service; no CVE id was provided
- USN-8747-1 fixes improper escaping of untrusted media metadata in Beets' web interface, enabling arbitrary HTML injection or JavaScript execution in a user's browser; no CVE id was provided
- USN-8571-2 fixes an Apache HTTP Server startup failure with HTTP/2 proxying enabled, a regression from USN-8571-1 caused by a missing library symbol
- The underlying Apache issues include CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, plus an HTTP response splitting flaw fixed in multiple modules, credited to Pavel Kohout, Arkadi Vainbrand,…
- Ubuntu 24.04.5 LTS point release bundles accumulated security and high-severity bug fixes into fresh install media for desktop, server, and nine flavors (Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio, Edubuntu among them)
- The 24.04.5 HWE stack upgrades to Linux 7.0 with Mesa 26.2 (per Cyber Security News, pulled from Ubuntu 26.04 LTS); the GA kernel stays on the 6.8 series; Livepatch covers the 7.0 HWE kernel on x86-64
- 24.04.5 release notes name no CVEs or bug IDs; support timelines run from the original 24.04 launch (five years for Desktop/Server/Cloud/Core, three for flavors; standard support through May 2029, ESM available to 2034)
Coverage
oldest first · one row per article · UTC- · Sep 10, 2026
Ubuntu Security NoticesFirst report
USN-8745-1: KissFFT vulnerabilities
Ubuntu released USN-8745-1 fixing two KissFFT flaws that could cause denial of service or arbitrary code execution.
- · Sep 10, 2026
USN-8746-1: libEBML vulnerability
Ubuntu released USN-8746-1 fixing a libEBML buffer overflow that could let an attacker cause a denial of service.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-34297 | KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit | 8.6 | <1% | ||
| CVE-2026-33007 | A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in… | 5.3 | <1% | ||
| CVE-2026-41445 | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size… | 8.7 | <1% |