{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "amd64-microcode", "perl-base", "tar", "xxd" ] } }, "diff": { "deb": [ { "name": "amd64-microcode", "from_version": { "source_package_name": "amd64-microcode", "source_package_version": "3.20250311.1ubuntu0.24.04.1", "version": "3.20250311.1ubuntu0.24.04.1" }, "to_version": { "source_package_name": "amd64-microcode", "source_package_version": "3.20251202.1ubuntu0.24.04.1", "version": "3.20251202.1ubuntu0.24.04.1" }, "cves": [ { "cve": "CVE-2025-62626", "url": "https://ubuntu.com/security/CVE-2025-62626", "cve_description": "Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.", "cve_priority": "medium", "cve_public_date": "2025-11-21 19:16:00 UTC" }, { "cve": "CVE-2024-36350", "url": "https://ubuntu.com/security/CVE-2024-36350", "cve_description": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.", "cve_priority": "medium", "cve_public_date": "2025-07-08 17:15:00 UTC" }, { "cve": "CVE-2024-36357", "url": "https://ubuntu.com/security/CVE-2024-36357", "cve_description": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.", "cve_priority": "medium", "cve_public_date": "2025-07-08 17:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-62626", "url": "https://ubuntu.com/security/CVE-2025-62626", "cve_description": "Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.", "cve_priority": "medium", "cve_public_date": "2025-11-21 19:16:00 UTC" }, { "cve": "CVE-2024-36350", "url": "https://ubuntu.com/security/CVE-2024-36350", "cve_description": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.", "cve_priority": "medium", "cve_public_date": "2025-07-08 17:15:00 UTC" }, { "cve": "CVE-2024-36357", "url": "https://ubuntu.com/security/CVE-2024-36357", "cve_description": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.", "cve_priority": "medium", "cve_public_date": "2025-07-08 17:15:00 UTC" } ], "log": [ "", " [ Henrique de Moraes Holschuh ]", " * Update package data from linux-firmware 20251202", " * ATTENTION: regression risk if backported to stable or LTS.", " The amd processor microcode updates in this release will not load on", " systems with outdated BIOS vulnerable to \"Entrysign\" unless a number of", " kernel patches are present.", " * amd-tee: update AMD PMF TA Firmware to v3.1.", " * amd-ucode: update with release 2025-12-02:", " + SECURITY UPDATE (AMD-SB-7055 / CVE-2025-62626)", " Fix RDSEED Failure on more AMD Zen 5 Processor models", " (closes: #1120005)", " * amd-ucode: update with release 2025-11-13:", " + SECURITY UPDATE (AMD-SB-7055 / CVE-2025-62626)", " Fix RDSEED Failure on more AMD Zen 5 Processor models", " * amd-ucode: update with release 2025-10-30:", " + SECURITY UPDATE (AMD-SB-7055 / CVE-2025-62626)", " Fix RDSEED Failure on some AMD Zen 5 Processor models", " + amd-ucode: update with release 2025-10-27:", " * This is the final microcode release for systems that have not", " been updated to fix vulnerability AMD-SB-7033 \"Entrysign\").", " * A kernel update is needed for the microcode driver to be able", " to select the appropriate microcode updates for outdated system", " firmware vulnerable to \"Entrysign\".", " * On non-updated kernels, this will potentially *regress* the", " microcode version on the running system back to the one in the", " (outdated, unpatched-for-Entrysign) BIOS.", " + amd-ucode: update with release 2025-07-29:", " + SECURITY UPDATE (AMD-SB-7029: CVE-2024-36350, CVE-2024-36357):", " Mitigate transient execution vulnerabilities in some AMD processors", " which might allow an attacker to infer data from previous stores", " (TSA-SQ) or data in the L1D cache (TSA-L1), potentially resulting in", " the leakage of privileged information and sensitive information across", " priviledged boundaries (closes: #1109035)", " * NOTE: Requires kernel and hypervisor changes for the security", " mitigations to be applied (issue VERW instruction at appropriate", " times).", " * NEWS.Debian: update for post-Entrysign microcode updates", " Document that kernel patches are needed to avoid regressing the microcode", " release on vulnerable Zen2/3/4 systems (family 0x19), and also that these", " systems will not receive any future microcode updates.", "", " [ Rodrigo Figueiredo Zaiden ]", " * Remaining changes:", " - debian/initramfs.hook: initramfs-tools hook:", " + Default to 'early' instead of 'auto' when building with", " MODULES=most", " + Do not override preset defaults from auto-exported conf", " snippets loaded by initramfs-tools.", "" ], "package": "amd64-microcode", "version": "3.20251202.1ubuntu0.24.04.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Rodrigo Figueiredo Zaiden ", "date": "Tue, 23 Jun 2026 10:53:03 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.2", "version": "5.38.2-3.2ubuntu0.2" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " targets against absolute paths and directory traversal in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-42496", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer", " overflow via quantified fixed-string regex in t/re/pat_psycho.t", " - debian/patches/CVE-2026-8376_2.patch: add overflow check before", " fixed-string buffer allocation in regcomp.c / regcomp_study.c", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.3", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Fri, 12 Jun 2026 16:42:23 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "tar", "from_version": { "source_package_name": "tar", "source_package_version": "1.35+dfsg-3build1", "version": "1.35+dfsg-3build1" }, "to_version": { "source_package_name": "tar", "source_package_version": "1.35+dfsg-3ubuntu0.1", "version": "1.35+dfsg-3ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: file injection via crafted archive", " - debian/patches/CVE-2026-5704.patch: always call skip_member() after", " extraction in src/extract.c, fix skim_member() to skip directory data", " in src/list.c, remove conditional skip_member() call from", " purge_directory in src/incremen.c", " - CVE-2026-5704", "" ], "package": "tar", "version": "1.35+dfsg-3ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Fri, 19 Jun 2026 11:00:21 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "xxd", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.15", "version": "2:9.1.0016-1ubuntu7.15" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.16", "version": "2:9.1.0016-1ubuntu7.16" }, "cves": [ { "cve": "CVE-2026-47162", "url": "https://ubuntu.com/security/CVE-2026-47162", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-47167", "url": "https://ubuntu.com/security/CVE-2026-47167", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52858", "url": "https://ubuntu.com/security/CVE-2026-52858", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52860", "url": "https://ubuntu.com/security/CVE-2026-52860", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52859", "url": "https://ubuntu.com/security/CVE-2026-52859", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-47162", "url": "https://ubuntu.com/security/CVE-2026-47162", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-47167", "url": "https://ubuntu.com/security/CVE-2026-47167", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52858", "url": "https://ubuntu.com/security/CVE-2026-52858", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52860", "url": "https://ubuntu.com/security/CVE-2026-52860", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" }, { "cve": "CVE-2026-52859", "url": "https://ubuntu.com/security/CVE-2026-52859", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.", "cve_priority": "medium", "cve_public_date": "2026-06-11 19:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Code injection via NetrwBookHistSave().", " - debian/patches/CVE-2026-47162.patch: Properly quote the directory name", " in runtime/autoload/netrw.vim.", " - CVE-2026-47162", " * SECURITY UPDATE: Code Injection in cucumber filetype plugin.", " - debian/patches/CVE-2026-47167.patch: Use rubys Regexp.new() in", " runtime/ftplugin/cucumber.vim.", " - CVE-2026-47167", " * SECURITY UPDATE: Code execution with python3complete.", " - debian/patches/CVE-2026-52858.patch: Disable execution of import/from", " statements in runtime/autoload/python3complete.vim and", " ../pythoncomplete.vim", " - debian/patches/CVE-2026-52860.patch: Strip default expressions and", " annotations in runtime/autoload/python3complete.vim and", " ../pythoncomplete.vim", " - CVE-2026-52858", " - CVE-2026-52860", " * SECURITY UPDATE: Out-of-bounds read in update_snapshot().", " - debian/patches/CVE-2026-52859.patch: Bound loop in handle_pushline() in", " src/terminal.c.", " - CVE-2026-52859", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.16", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 15 Jun 2026 16:17:35 -0600" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from release image serial 20260617 to 20260626", "from_series": "noble", "to_series": "noble", "from_serial": "20260617", "to_serial": "20260626", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }