Ubuntu issues security notices for KissFFT, libEBML, Beets and Apache regression, plus 24.04.5 LTS point release

Ubuntu published four security notices fixing KissFFT flaws that could cause denial of service or arbitrary code execution, a libEBML buffer overflow, Beets HTML/JavaScript injection, and an Apache HTTP Server startup regression, while the Ubuntu 24.04.5 LTS…

On 2026-09-10, Ubuntu released three new security notices and a regression fix. USN-8745-1 fixes two KissFFT flaws, CVE-2025-34297 (large Fourier transform sizes mishandled on 32-bit architectures) and CVE-2026-41445 (multidimensional Fourier transform sizes); either issue could crash KissFFT, resulting in denial of service or arbitrary code execution. USN-8746-1 fixes incorrect handling of certain read and write operations in libEBML, which could allow a buffer overflow resulting in denial of service; no CVE id was given for this flaw. USN-8747-1 fixes a Beets web interface vulnerability in which untrusted media metadata was incorrectly escaped, letting an attacker inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser; no CVE id was given. USN-8571-2 fixes a regression introduced by USN-8571-1: the earlier fix was incomplete due to a missing library symbol, causing Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. The original USN-8571-1 advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability fixed in multiple Apache modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab, and Dawit Jeong. Separately, Canonical released Ubuntu 24.04.5 LTS, the fifth maintenance point release of the 24.04 'Noble Numbat' series, bundling accumulated security corrections and high-severity bug fixes into new installation media for desktop, server, and nine flavors including Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio, and Edubuntu. According to Cyber Security News, the Hardware Enablement kernel stack moves to Linux 7.0 with Mesa 26.2 (pulled from Ubuntu 26.04 LTS) while the GA kernel remains on the 6.8 series, and Livepatch covers the 7.0 HWE kernel on x86-64; Help Net Security's coverage of the release names no CVEs or bug IDs. Existing 24.04 systems receive the same fixes through regular updates, and 22.04 LTS users get them via the automatic upgrade path at no cost. Support timelines still count from the original 24.04 launch: five years for Desktop/Server/Cloud/Core and three for flavors (standard support through May 2029), extendable with Expanded Security Maintenance to 2034.

• USN-8745-1 fixes two KissFFT flaws, CVE-2025-34297 and CVE-2026-41445, which could cause denial of service or arbitrary code execution; the first involves large Fourier transform sizes on 32-bit architectures, the second multidimensional…