Ubuntu security wave: six notices patch PHP, Python, KissFFT, libEBML, Beets and Apache, capped by 24.04.5 LTS point release with Linux 7.0 HWE kernel
On 2026-09-10 Ubuntu published six security notices (USN-8743-1 through USN-8747-1 plus regression fix USN-8571-2) covering PHP, Python, KissFFT, libEBML, Beets and Apache HTTP Server, then on 2026-09-11 released Ubuntu 24.04.5 LTS, which bundles accumulated…
Canonical issued a burst of Ubuntu security activity across 2026-09-10 and 2026-09-11. On 2026-09-10, USN-8743-1 fixed three PHP flaws: CVE-2026-17543 (SQL injection via incorrect backslash escaping in the PostgreSQL extension), CVE-2026-17544 (out-of-bounds write in bccomp() that could cause denial of service or arbitrary code execution, noted on Ubuntu 26.04 LTS) and CVE-2026-7260 (unbounded recursion from circular symlinks in phar archives, causing DoS). USN-8744-1 fixed two Python issues affecting Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04 and 24.04 LTS: CVE-2026-3644 (control-character mishandling in http.cookies enabling arbitrary content injection) and unbounded recursion in the Expat XML parser via the pyexpat module that could crash Python; no exploitation in the wild is reported. USN-8745-1 fixed two KissFFT flaws, CVE-2025-34297 (large Fourier transform sizes mishandled on 32-bit architectures) and CVE-2026-41445 (multidimensional Fourier transform sizes), either of which could cause DoS or arbitrary code execution. USN-8746-1 fixed a libEBML buffer overflow from mishandled read/write operations that could cause DoS (no CVE id cited), and USN-8747-1 fixed a Beets web interface flaw in which untrusted media metadata was incorrectly escaped, allowing arbitrary HTML injection or JavaScript execution (no CVE id cited). USN-8571-2 corrected a regression in the earlier Apache HTTP Server update USN-8571-1: a missing library symbol made Apache fail to start when HTTP/2 proxying was enabled. The underlying USN-8571-1 advisory covered CVE-2026-33007 (a memory-handling flaw in mod_authn_socache allowing remote DoS) and an HTTP response splitting vulnerability fixed in multiple modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab and Dawit Jeong. On 2026-09-11 Canonical released Ubuntu 24.04.5 LTS, the fifth point release of the Noble Numbat series, folding accumulated security corrections and high-severity bug fixes into new installation media for desktop, server and nine official flavors including Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio and Edubuntu. The HWE kernel stack moves to Linux 7.0 with Mesa 26.2 (pulled from Ubuntu 26.04 LTS) while the GA kernel remains on the 6.8 series, and Livepatch covers the 7.0 HWE kernel on x86-64. Existing 24.04 systems receive the same fixes via regular updates, and existing 22.04 LTS users get them through the free automatic upgrade path. The point release notes name no CVEs or bug…
- USN-8743-1 (2026-09-10) fixes three PHP flaws: CVE-2026-17543 (SQL injection via incorrect backslash escaping in the PostgreSQL extension), CVE-2026-17544 (out-of-bounds write in bccomp(), DoS or arbitrary code execution on Ubuntu 26.04…
- USN-8744-1 (2026-09-10) fixes CVE-2026-3644 (http.cookies control-character mishandling allowing arbitrary content injection) plus a pyexpat/Expat unbounded-recursion DoS, affecting Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04 and 24.04 LTS;…
- USN-8745-1 (2026-09-10) fixes KissFFT CVE-2025-34297 (large Fourier transform sizes mishandled on 32-bit architectures) and CVE-2026-41445 (multidimensional Fourier transform sizes); either flaw could cause DoS or arbitrary code execution.
- USN-8746-1 (2026-09-10) fixes a libEBML buffer overflow from incorrect handling of certain read and write operations, which could cause denial of service; no CVE id was given in the report.
- USN-8747-1 (2026-09-10) fixes a Beets web interface flaw: improper escaping of untrusted media metadata allowed arbitrary HTML injection or JavaScript execution in a user's browser; no CVE id was given in the report.
- USN-8571-2 (2026-09-10) fixes an Apache HTTP Server regression from USN-8571-1 caused by a missing library symbol, which made Apache fail to start when HTTP/2 proxying was enabled.
- The underlying USN-8571-1 advisory addressed CVE-2026-33007 (memory-handling flaw in mod_authn_socache allowing remote DoS) and an HTTP response splitting vulnerability fixed in multiple modules, credited to Pavel Kohout, Arkadi Vainbrand,…
- Ubuntu 24.04.5 LTS (released 2026-09-11) is the fifth point release of the 24.04 'Noble Numbat' series and bundles accumulated security fixes into fresh install media for desktop, server and nine official flavors including Kubuntu,…
Coverage timelineoldest first · each row is one article
- · 7d agoUSN-8743-1: PHP vulnerabilities
Ubuntu Security Notices· 28
Ubuntu fixes three PHP flaws, including SQL injection in the PostgreSQL extension (CVE-2026-17543) and an out-of-bounds write in bccomp().
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-34297 | KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures. NVD description · AI analysis pending | 8.6 | <1% | — | — | ||
| CVE-2026-17544 | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9. NVD description · AI analysis pending | 8.1 group max | <1% |
| — | ||
| CVE-2026-33007 | A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue. NVD description · AI analysis pending | 5.3 | <1% |
| — | ||
| CVE-2026-3644 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output(). NVD description · AI analysis pending | 6.0 | <1% |
| — | ||
| CVE-2026-41445 | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculat KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data. NVD description · AI analysis pending | 8.7 | <1% | — | — |