Ubuntu security noticeshttps://ubuntu.com/security/notices/rss.xmlRecent content on Ubuntu security notices2026 Canonical Ltd. Ubuntu and Canonical are registered trademarks of Canonical Ltd.http://www.rssboard.org/rss-specificationFeedgen2026年9月05日 03:41:51 +0000USN-8714-2: Linux kernel vulnerabilitieshttps://ubuntu.com/security/notices/USN-8714-2Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- OCFS2 file system;
- SCTP protocol;
(CVE-2026-53043, CVE-2026-53224, CVE-2026-53225, CVE-2026-53246,
CVE-2026-53309)
https://ubuntu.com/security/notices/USN-8714-22026年9月04日 17:55:21 +0000USN-8725-1: Linux kernel vulnerabilitieshttps://ubuntu.com/security/notices/USN-8725-1Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVIDIA Tegra memory controller driver;
- File systems infrastructure;
- Network file system (NFS) server daemon;
- OCFS2 file system;
- B.A.T.M.A.N. meshing protocol;
- Netfilter;
- SCTP protocol;
(CVE-2022-50401, CVE-2026-43071, CVE-2026-52914, CVE-2026-53002,
CVE-2026-53043, CVE-2026-53045, CVE-2026-53224, CVE-2026-53309)
https://ubuntu.com/security/notices/USN-8725-12026年9月04日 17:51:55 +0000USN-8724-1: rabbitmq-c vulnerabilitieshttps://ubuntu.com/security/notices/USN-8724-1It was discovered that the rabbitmq-c command-line tools only accepted
credentials on the command line, making them visible to other local users
through the process list. An attacker could possibly use this to obtain
sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)
It was discovered that rabbitmq-c did not correctly compute AMQP frame
lengths, leading to a size_t underflow. A remote attacker could possibly
use this to cause rabbitmq-c to crash, resulting in a denial of service, or
possibly expose sensitive information. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-44235)
It was discovered that rabbitmq-c did not properly validate the frame size
during the AMQP login handshake. A remote attacker could possibly use this
to cause a heap buffer overflow, resulting in a denial of service or
possibly the execution of arbitrary code. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-44236)
It was discovered that rabbitmq-c did not correctly validate the length of
decoded bytes fields, leading to an integer overflow in a bounds check on
32-bit systems. A remote attacker controlling a broker, or able to
intercept an unencrypted connection, could possibly use this to cause an
out-of-bounds read, resulting in a denial of service or the exposure of
sensitive information. (CVE-2026-59986)
It was discovered that rabbitmq-c did not validate the body fragment length
when serialising an AMQP body frame with the amqp_send_frame() API. An
attacker could possibly use this to cause a heap buffer overflow, resulting
in a denial of service (application crash) or possibly the execution of
arbitrary code. This issue did not affect Ubuntu 14.04 LTS.
(CVE-2026-61547)https://ubuntu.com/security/notices/USN-8724-12026年9月03日 15:51:03 +0000USN-8720-1: GnuPG vulnerabilityhttps://ubuntu.com/security/notices/USN-8720-1It was discovered that GnuPG incorrectly validated authentication tag
lengths when parsing CMS messages encrypted with AES-GCM. An attacker could
possibly use this issue to bypass message integrity checks.https://ubuntu.com/security/notices/USN-8720-12026年9月03日 12:55:50 +0000USN-8723-1: SPICE vdagent vulnerabilitieshttps://ubuntu.com/security/notices/USN-8723-1It was discovered that SPICE vdagent had an integer overflow in the buffer
size calculation used when writing to the daemon socket. A malicious or
compromised SPICE host could possibly use this issue to cause SPICE vdagent
to crash, resulting in a denial of service. (CVE-2026-57965)
It was discovered that SPICE vdagent did not properly sanitize filenames
provided by the SPICE host during file transfers. A malicious or
compromised SPICE host could possibly use this issue to write arbitrary
files to any location on the guest operating system with the privileges of
the spice-vdagent process. (CVE-2026-57966)https://ubuntu.com/security/notices/USN-8723-12026年9月03日 12:43:08 +0000USN-8722-1: libssh2 vulnerabilitieshttps://ubuntu.com/security/notices/USN-8722-1It was discovered that libssh2 incorrectly handled certain SFTP server
responses. A remote attacker controlling an SSH server could use this issue
to cause libssh2 to crash or possibly execute arbitrary code.
(CVE-2026-66032)
It was discovered that libssh2 incorrectly handled AES-GCM cipher
negotiation. A remote attacker controlling an SSH server could possibly use
this issue to cause libssh2 to crash, resulting in a denial of service.
(CVE-2026-66033)
It was discovered that libssh2 incorrectly handled Encrypt-then-MAC cipher
negotiation. A remote attacker controlling an SSH server could use this
issue to cause libssh2 to crash or possibly execute arbitrary code.
(CVE-2026-66035)https://ubuntu.com/security/notices/USN-8722-12026年9月03日 12:37:05 +0000USN-8719-1: APR-util vulnerabilitieshttps://ubuntu.com/security/notices/USN-8719-1It was discovered that APR-util incorrectly performed password hash
comparisons in a way that was not constant-time.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2025-49506)
It was discovered that APR-util incorrectly handled recursive XML element
quoting. An attacker could possibly use this issue to cause applications
using APR-util to crash, resulting in a denial of service.
(CVE-2026-32327)
It was discovered that the APR-util Redis client incorrectly handled
certain network data, resulting in a heap-based buffer overflow. A remote
attacker could possibly use this issue to cause APR-util applications to
crash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-34501)
It was discovered that the APR-util memcached client incorrectly handled
certain network data, resulting in a heap-based buffer overflow. A remote
attacker could possibly use this issue to cause APR-util applications to
crash or execute arbitrary code. (CVE-2026-34502)https://ubuntu.com/security/notices/USN-8719-12026年9月03日 12:35:55 +0000USN-8721-1: OpenSSH vulnerabilitieshttps://ubuntu.com/security/notices/USN-8721-1It was discovered that OpenSSH's ssh-agent incorrectly handled interactions
between agent locking and the session-bind@openssh.com extension. A remote
attacker with access to a forwarded agent connection could possibly use
this issue to perform operations that should only be available locally,
such as adding tokens or using keys. (CVE-2026-73281)
It was discovered that OpenSSH's ssh client incorrectly handled concurrent
remote-forwarding operations. A remote attacker could possibly use this
issue to cause a use-after-free condition, resulting in a denial of service
or the execution of arbitrary code. (CVE-2026-73282)
It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keyword from authorized_keys to tunnel forwarding requests. A
local attacker with an authorized key could possibly use this issue to
bypass intended tunnel forwarding restrictions. (CVE-2026-73283)https://ubuntu.com/security/notices/USN-8721-12026年9月03日 12:30:15 +0000USN-8718-1: SSSD vulnerabilityhttps://ubuntu.com/security/notices/USN-8718-1It was discovered that SSSD did not properly validate authentication token
lengths when processing PAM responder requests. A local attacker could
possibly use this issue to cause SSSD to crash, resulting in a denial of
service.https://ubuntu.com/security/notices/USN-8718-12026年9月03日 12:00:57 +0000USN-8716-1: FFmpeg vulnerabilitieshttps://ubuntu.com/security/notices/USN-8716-1It was discovered that FFmpeg incorrectly handled certain crafted media
files in the VobSub subtitle demuxer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64830)
It was discovered that FFmpeg incorrectly handled certain crafted DTS
audio streams in the S/PDIF muxer. An attacker could possibly use this
issue to cause a denial of service or expose sensitive information.
(CVE-2026-64833)
It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF
streams. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-64834)
It was discovered that FFmpeg incorrectly handled certain crafted ADX
audio files. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2026-64835)
It was discovered that FFmpeg incorrectly handled certain crafted AVI
files in the TDSC video decoder. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65703)
It was discovered that FFmpeg incorrectly handled certain crafted
ffconcat files processed via the TY demuxer. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2026-65704)
It was discovered that FFmpeg incorrectly handled certain crafted video
streams in the vf_floodfill video filter. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04
LTS. (CVE-2026-65705)
It was discovered that FFmpeg incorrectly handled certain crafted NV12
video frames in the vf_swaprect video filter. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04
LTS. (CVE-2026-65706)
It was discovered that FFmpeg incorrectly handled certain crafted hvcC
NAL arrays in the HEVC parser. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75141)
It was discovered that FFmpeg incorrectly handled certain crafted MPEG
system headers. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-75142)
It was discovered that FFmpeg incorrectly handled certain crafted
network input in the librist protocol handler. This issue only
affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-75143)
It was discovered that FFmpeg incorrectly handled certain crafted Dirac
data units in the VC2 HQ RTP packetizer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75144)
It was discovered that FFmpeg incorrectly handled certain crafted DASH
manifests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-75146)https://ubuntu.com/security/notices/USN-8716-12026年9月03日 11:06:14 +0000