https://ubuntu.com/security/notices/rss.xmlRecent content on Ubuntu security notices2026 Canonical Ltd. Ubuntu and Canonical are registered trademarks of Canonical Ltd.http://www.rssboard.org/rss-specificationFeedgenThu, 20 Aug 2026 13:39:51 +0000https://ubuntu.com/security/notices/USN-8653-1It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. (CVE-2026-6464) It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER TABLE ALTER TYPE operations. An attacker could possibly use this issue to obtain sensitive information or gain unintended privileges. (CVE-2026-6469) It was discovered that PostgreSQL failed to check the USAGE privilege on types. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-6470) It was discovered that PostgreSQL logical decoding could load arbitrary shared libraries. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-6471) It was discovered that PostgreSQL had integer wraparound issues in tsvector and tsquery allocations. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14662) It was discovered that PostgreSQL pgcrypto silently used cleartext when OpenSSL-disabled ciphers were requested. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14663) It was discovered that PostgreSQL had a heap buffer overflow in regular expression processing. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14664) It was discovered that PostgreSQL row security policies were not properly invalidated when roles were modified. An attacker could possibly use this issue to bypass intended row security restrictions. (CVE-2026-14666) It was discovered that PostgreSQL had a type confusion issue in the selectivity estimator involving ctid. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14668) It was discovered that PostgreSQL had a heap buffer overflow in the to_char function. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14669) It was discovered that PostgreSQL had a heap buffer overflow in the PL/Perl tied object handling. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14670) It was discovered that PostgreSQL had a type confusion issue in the referential integrity plan cache. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14671) It was discovered that PostgreSQL had an observable response discrepancy when non-default scram_iterations were used. A remote attacker could possibly use this issue to enumerate valid usernames. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-14672) It was discovered that PostgreSQL amcheck did not clear untrusted search paths. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14673) It was discovered that PostgreSQL had a heap buffer overflow in pg_stat_statements. An authenticated user could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14676) It was discovered that PostgreSQL had integer wraparound issues in PL/Tcl and PL/Perl allocations on 32-bit systems. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14677) It was discovered that PostgreSQL pg_trgm read past the end of a buffer during picksplit operations. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14678) It was discovered that PostgreSQL had a stack buffer overflow in argument matching. An authenticated user could possibly use this issue to corrupt server memory. (CVE-2026-14679) It was discovered that PostgreSQL had a type confusion issue when functions used internal arguments. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14680) It was discovered that PostgreSQL did not properly enforce GSSAPI encryption when used together with SSL. An attacker could possibly use this issue to perform a machine-in-the-middle attack and obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14681) It was discovered that PostgreSQL allowed SQL injection through EXTRACT arguments during expression deparsing. An authenticated user could possibly use this issue to perform SQL injection attacks. (CVE-2026-15741) It was discovered that PostgreSQL fuzzystrmatch had integer wraparound issues that could write to arbitrary addresses. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-15742) It was discovered that PostgreSQL had a type confusion issue in pg_restore_attribute_stats(). An authenticated user could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-16238) It was discovered that PostgreSQL had a type confusion issue when handling cursor CLOSE and DECLARE operations. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-16239) It was discovered that PostgreSQL had an integer underflow in the ECPG client library. An attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. (CVE-2026-16241) It was discovered that PostgreSQL had an out-of-bounds read in the ascii() function. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-18024) It was discovered that the psql \unrestrict command allowed the superuser of a pg_dump origin server to execute arbitrary code in the psql client. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-18408) It was discovered that PostgreSQL pg_dump had a heap buffer overflow. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-19385)https://ubuntu.com/security/notices/USN-8653-1Thu, 20 Aug 2026 11:42:58 +0000https://ubuntu.com/security/notices/USN-8563-4USN-8563-3 fixed a vulnerability in nginx. The fix introduced a regression in certain environments. This update reverts the fix for CVE-2026-42533 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533) It was discovered that nginx had a use-after-free vulnerability in the ngx_http_ssi_module module when configured with Server-Side Includes, proxy_pass, and proxy buffering disabled directives. An attacker able to intercept traffic and control responses from an upstream server could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-56434) It was discovered that nginx incorrectly handled certain requests in the ngx_http_slice_module module. A remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash, resulting in a denial of service. (CVE-2026-60005)https://ubuntu.com/security/notices/USN-8563-4Wed, 19 Aug 2026 19:30:43 +0000https://ubuntu.com/security/notices/USN-8651-1It was discovered that curl incorrectly handled reusing connections when the origin changed between transfers. A remote attacker could possibly use this issue to obtain sensitive information.https://ubuntu.com/security/notices/USN-8651-1Wed, 19 Aug 2026 16:44:20 +0000https://ubuntu.com/security/notices/USN-8650-1Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request or response smuggling. (CVE-2026-32239, CVE-2026-32240)https://ubuntu.com/security/notices/USN-8650-1Wed, 19 Aug 2026 16:00:14 +0000https://ubuntu.com/security/notices/USN-8649-1It was discovered that libheif had an integer underflow in the Fraction constructor when a clap transform was applied twice. An attacker could possibly use this issue to cause libheif to crash, resulting in a denial of service. (CVE-2026-62289) It was discovered that libheif had an out-of-bounds read in uncompressed tile range slicing. An attacker could possibly use this issue to cause libheif to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10. (CVE-2026-62292)https://ubuntu.com/security/notices/USN-8649-1Wed, 19 Aug 2026 12:39:30 +0000https://ubuntu.com/security/notices/USN-8563-3USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was backed out in USN-8563-2 because it could cause a regression. This update includes a better fix for CVE-2026-42533. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533) It was discovered that nginx had a use-after-free vulnerability in the ngx_http_ssi_module module when configured with Server-Side Includes, proxy_pass, and proxy buffering disabled directives. An attacker able to intercept traffic and control responses from an upstream server could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-56434) It was discovered that nginx incorrectly handled certain requests in the ngx_http_slice_module module. A remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash, resulting in a denial of service. (CVE-2026-60005)https://ubuntu.com/security/notices/USN-8563-3Wed, 19 Aug 2026 12:01:08 +0000https://ubuntu.com/security/notices/USN-8648-1It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. (CVE-2026-10723) It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-10822) It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331) It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605) It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. (CVE-2026-11622) It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. (CVE-2026-11721) It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-12617) It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)https://ubuntu.com/security/notices/USN-8648-1Wed, 19 Aug 2026 11:45:39 +0000https://ubuntu.com/security/notices/USN-8093-2USN-8093-1 fixed a vulnerability in libssh. This update provides the corresponsing fix for Ubuntu 26.04 LTS. Original advisory details: It was discovered that libssh incorrectly performed bounds checking when processing SFTP extensions. If a client application queried extension data out of bounds, it could cause the application to crash, resulting in a denial of service, or exhibit unintended behavior.https://ubuntu.com/security/notices/USN-8093-2Wed, 19 Aug 2026 08:15:33 +0000https://ubuntu.com/security/notices/USN-8113-2USN 8113-1 fixed vulnerabilities in tiff. This update provides the corresponding fixes for Ubuntu 26.04 LTS. Original advisory details: It was discovered that LibTIFF did not properly handle memory when processing certain images. An attacker could possibly use this issue to cause LibTIFF to crash, resulting in a denial of service. (CVE-2025-61143) It was discovered that LibTIFF did not properly handle memory when processing malformed TIFF directories. An attacker could possibly use this issue to cause LibTIFF to crash, resulting in a denial of service. (CVE-2025-61144)https://ubuntu.com/security/notices/USN-8113-2Wed, 19 Aug 2026 07:39:43 +0000https://ubuntu.com/security/notices/USN-8630-3Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Mellanox network drivers; - File systems infrastructure; - IPv4 networking; - Network traffic control; - TCP network protocol; - B.A.T.M.A.N. meshing protocol; - IPv6 networking; - Multipath TCP; - Netfilter; - RxRPC session sockets; - SCTP protocol; - SMC sockets; (CVE-2026-43083, CVE-2026-43197, CVE-2026-43198, CVE-2026-43465, CVE-2026-46242, CVE-2026-46325, CVE-2026-46331, CVE-2026-52914, CVE-2026-52924, CVE-2026-52931, CVE-2026-53151, CVE-2026-53176, CVE-2026-53212, CVE-2026-53215, CVE-2026-53225, CVE-2026-53228, CVE-2026-53359) https://ubuntu.com/security/notices/USN-8630-3Tue, 18 Aug 2026 21:00:12 +0000