{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "perl-base", "tar" ] } }, "diff": { "deb": [ { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.2", "version": "5.38.2-3.2ubuntu0.2" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" }, { "cve": "CVE-2026-8376", "url": "https://ubuntu.com/security/CVE-2026-8376", "cve_description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "cve_priority": "medium", "cve_public_date": "2026-05-26 00:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " targets against absolute paths and directory traversal in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-42496", " * SECURITY UPDATE: integer overflow in regular expression compiler", " - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer", " overflow via quantified fixed-string regex in t/re/pat_psycho.t", " - debian/patches/CVE-2026-8376_2.patch: add overflow check before", " fixed-string buffer allocation in regcomp.c / regcomp_study.c", " - CVE-2026-8376", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.3", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Fri, 12 Jun 2026 16:42:23 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "tar", "from_version": { "source_package_name": "tar", "source_package_version": "1.35+dfsg-3build1", "version": "1.35+dfsg-3build1" }, "to_version": { "source_package_name": "tar", "source_package_version": "1.35+dfsg-3ubuntu0.1", "version": "1.35+dfsg-3ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: file injection via crafted archive", " - debian/patches/CVE-2026-5704.patch: always call skip_member() after", " extraction in src/extract.c, fix skim_member() to skip directory data", " in src/list.c, remove conditional skip_member() call from", " purge_directory in src/incremen.c", " - CVE-2026-5704", "" ], "package": "tar", "version": "1.35+dfsg-3ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Fri, 19 Jun 2026 11:00:21 -0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from daily image serial 20260619 to 20260626", "from_series": "noble", "to_series": "noble", "from_serial": "20260619", "to_serial": "20260626", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }