Ubuntu 26.10 curl checks certificate revocation; OpenSSL is next
The check uses local CRLite data via upki, so curl no longer waits on a network revocation lookup.
Stories per day · 30 days
18 RSS
Relateddenial-of-service39linux-kernel37usn21canonical12use-after-free8java7linux7remote-code-execution7ca-certificates6advisory5amd5authentication5curl5dns5nvidia5openjdk5regression5sev-snp5
296 stories, newest first · one card per story
Stories tagged #ubuntu
Ubuntu update delayed for critical CVE-2026-98432
Ubuntu has left critical CVE-2026-98432 unpatched for nearly a week despite a 9.8 severity rating and available mitigation.
Ubuntu fixes local flaws in uutils coreutils mkfifo, dd and tail
mkfifo can reset permissions on an existing file, and dd can hide truncation errors that corrupt data.
Ubuntu patches Linux kernel flaws, including AMD SEV-SNP issue
A local attacker with hypervisor access could use CVE-2023-20585 to corrupt SEV-SNP guest memory integrity.
Ubuntu kernel update addresses flaws that could compromise the system
USN-9027-1 covers x86, hardware monitoring, OCFS2, IPv4, Ethernet bridge, Netfilter and XFRM flaws.
Ubuntu fixes Tornado update that blocked symlinked static files
USN-8952-3 corrects an incomplete fix that returned 403 errors for symlinks into directories such as /usr/share.
Ubuntu patches Linux kernel flaws in Azure CVM images
USN-9039-1 says an attacker could possibly use flaws in multiple kernel subsystems to compromise the system.
Ubuntu warns of HPLIP memory flaws that may allow code execution
Two named CVEs cover memory corruption; a third issue is insecure file permissions, with no exploitation stated.
Ubuntu fixes GStreamer plugin flaws that can crash or run code
Network-stream and Matroska issues are limited to Ubuntu 16.04, 18.04, and 20.04 LTS; the notice is cut off.
Ubuntu 26.10 gets Unbound fixes from USN-8946-1
CVE-2026-80225 can let a remote attacker exhaust Unbound resources over TCP on listed LTS releases.
Ubuntu 18.04 and 20.04 get ca-certificates JKS keystore fix
CA certificates removed from the system bundle could remain in the Java JKS keystore until this resync.
Ubuntu fixes Linux kernel flaws in drivers, F2FS and networking
USN-9032-1 lists nine CVEs spanning GPU, bonding, F2FS, tracing, networking core, IUCV and RxRPC.
Ubuntu warns of Apache HTTP Server DoS and cookie leak
CVE-2026-46729 affects Ubuntu 14.04 LTS through 26.04 LTS; the snippet states no fixed versions.
Ubuntu fixes libsoup cookie-jar leak from USN-8890-1
The follow-up also restates HTTP/2 denial of service and HTTPS proxy disclosure, including CVE-2026-4271.
Ubuntu fixes OpenJDK 21 flaws that can expose or alter data
Remote attackers could modify data via Security and JSSE issues; one Compiler flaw needs no authentication.
Ubuntu fixes Fetchmail denial-of-service flaws in USN-9013-1
Two named issues can crash Fetchmail on Ubuntu 16.04, 18.04 and 20.04 LTS; the notice snippet cuts off a third finding.
libheif can run code from crafted HEIF images
Ubuntu says opening a malicious HEIF file, by a user or automated system, could lead to arbitrary code execution.
pyasn1 parsing bugs can exhaust CPU when decoding ASN.1
CVE-2026-59884 affects only Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS.
libnfs ZDR decoding flaw can crash the library or run code
Ubuntu says missing maximum-size enforcement during ZDR decoding causes an out-of-bounds write in libnfs.
Ubuntu USN-9007-1: FreeRDP flaws can leak data or run code
The notice says the issues can also crash FreeRDP; the snippet lists no CVE ids or fixed versions.
Ubuntu extends nginx security fixes to older LTS releases (USN-8955-2)
The notice also fixes CVE-2026-42533, which can let a remote attacker crash nginx or possibly run code.
Ubuntu fixes FRR RPKI regression in USN-7230-3
USN-7230-3 restores RPKI support in FRR after regression introduced by CVE-2024-55553 fix.
Ubuntu fixes HAProxy regression on 22.04 after security update
The earlier fix for truncated HTTP/2 PING handling could exhaust CPU; the follow-up corrects a chunked-request regression.
Debian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)
CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.