Your IP : 216.73.216.238
25/09/2026, commit https://github.com/canonical/core-base/tree/1cac06cab8094a93e75b12b8c4338517201168ce
[ Changes in the core26 snap ]
Meulengracht (1):
Makefile: make sure we keep an original manifest copy for sbom (#473)
[ Changes in primed packages ]
libexpat1 (built from expat) updated from 2.7.4-1 to 2.7.4-1ubuntu0.2:
expat (2.7.4-1ubuntu0.2) resolute-security; urgency=medium
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56410-1.patch: xmlwf: protect resolveSystemId from
integer overflow in expat/xmlwf/xmlfile.c.
- debian/patches/CVE-2026-56410-2.patch: xmlwf: guard each operator in
resolveSystemId length sum in expat/xmlwf/xmlfile.c.
- CVE-2026-56410
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56406.patch: lib: Copy overflow check from
`XML_Parse` to `XML_ParseBuffer` in expat/lib/xmlparse.c.
- CVE-2026-56406
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56409.patch: xmlwf: protect output path join from
integer overflow in expat/xmlwf/xmlwf.c.
- CVE-2026-56409
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56407.patch: cap entity textLen against signed
integer overflow in expat/lib/xmlparse.c.
- CVE-2026-56407
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56411.patch: xmlwf: protect notation list
allocation from integer overflow in expat/xmlwf/xmlwf.c.
- CVE-2026-56411
* SECURITY UPDATE: use after free
- debian/patches/CVE-2026-56131.patch: lib: protect XML_ResumeParser from
being called from a handler in expat/lib/xmlparse.c,
expat/tests/handlers.c, expat/tests/handlers.h, expat/tests/misc_tests.c.
- CVE-2026-56131
* SECURITY UPDATE: heap-based buffer overflow
- debian/patches/CVE-2026-56132-pre.patch: lib: use a `size_t` for group
sizes in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-56132-1.patch: lib: Remove reuse of `m_groupSize`
to count `m_scaffIndex` allocation in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-56132-2.patch: lib: doProlog: Fix out-of-bound
scaffolding index store in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-56132-3.patch: tests: Add a test case for
scaffolding array limits in shared DTDs in expat/tests/basic_tests.c.
- debian/patches/CVE-2026-56132-4.patch: lib: Remove unnecessary
`scaffIndex` expansion in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-56132-5.patch: lib: Remove indented scoping of
`new_connector` local in expat/lib/xmlparse.c.
- CVE-2026-56132
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2026-72522-1.patch: lib: Improve in-code comment for
functions *toUtf16 in expat/lib/xmltok.c.
- debian/patches/CVE-2026-72522-2.patch: lib: Stop functions *_toUtf16 from
mis-classifying low surrogates as high surrogates in expat/lib/xmltok.c.
- debian/patches/CVE-2026-72522-3.patch: tests/misc_tests.c: Cover Unicode
surrogate mix-up in expat/tests/misc_tests.c.
- debian/patches/CVE-2026-72522-4.patch: lib: Make an exit condition in
`storeAttributeValue` more defensive in expat/lib/xmlparse.c.
- CVE-2026-72522
* SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())
- debian/patches/CVE-2026-66046.patch: lib: Rename hash table
`defaultAttsNames` to `defaultAttForName` in expat/lib/xmlparse.c.
- CVE-2026-66046
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash
table entries created by dtdCopy in expat/lib/xmlparse.c,
expat/tests/basic_tests.c.
- CVE-2026-76641
* SECURITY UPDATE: use after free
- debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks
from parser reentry in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback
reentry protection in expat/tests/misc_tests.c.
- CVE-2026-76957
-- Isabel Garcia Contreras <isabel.garcia@canonical.com> Mon, 21 Sep 2026 15:56:10 -0400
expat (2.7.4-1ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: NULL function-pointer dereference
- debian/patches/CVE-2026-32776.patch: Fix NULL function-pointer dereference
for empty external parameter entities in expat/lib/xmlparse.c,
expat/tests/basic_tests.c.
- CVE-2026-32776
* SECURITY UPDATE: infinite loop while parsing DTD content
- debian/patches/CVE-2026-32777-1.patch: lib: Reject XML_TOK_INSTANCE_START
infinite loop in entityValueProcessor in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-32777-2.patch: misc_tests.c: Cover
XML_TOK_INSTANCE_START infinite loop case in expat/tests/misc_tests.c.
- CVE-2026-32777
* SECURITY UPDATE: NULL pointer dereference
- debian/patches/CVE-2026-32778-1.patch: copy prefix name to pool before
lookup in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-32778-2.patch: test that we do not end up with a
zombie PREFIX in the pool in expat/tests/nsalloc_tests.c.
- CVE-2026-32778
* SECURITY UPDATE: denial of service via moderately sized crafted XML input
- debian/patches/CVE-2026-45186-1.patch: Make
"counting_start_element_handler" count default attrs in
expat/tests/basic_tests.c, expat/tests/handlers.c, expat/tests/handlers.h.
- debian/patches/CVE-2026-45186-2.patch: test(attlist): Cover duplicate
attribute names in expat/tests/basic_tests.c.
- debian/patches/CVE-2026-45186-3.patch: tests: Define .attributes the first
time around in expat/tests/basic_tests.c.
- debian/patches/CVE-2026-45186-4.patch: tests: Make
counting_start_element_handler enforce complete attribute lists in
expat/tests/handlers.c.
- debian/patches/CVE-2026-45186-5.patch: lib: Extract a constant for
upcoming reuse in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-45186-6.patch: lib: Introduce
ELEMENT_TYPE.defaultAttsNames in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-45186-7.patch: lib: Leverage
ELEMENT_TYPE.defaultAttsNames for attribute collision detection in
expat/lib/xmlparse.c.
- CVE-2026-45186
* SECURITY UPDATE: hash flooding caused by insufficient entropy
- debian/patches/CVE-2026-41080-1.patch: lib: Inline function
`get_hash_secret_salt` in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-2.patch: lib: Drop unused parameter from
function `generate_hash_secret_salt` in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-3.patch: lib: Migrate hash salt storage to
larger `struct sipkey` in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-4.patch: lib: Drop unneeded `void *` casts
in function `generate_hash_secret_salt` in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-5.patch: lib: Extract 16 bytes of entropy
(instead of 4 to 8) for hash flooding protection in expat/lib/internal.h,
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-6.patch: lib: Introduce internal flag
`m_hash_secret_salt_set` in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-7.patch: lib: Introduce API function
`XML_SetHashSalt16Bytes` in expat/lib/expat.h, expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-8.patch: lib: Include `XML_SetHashSalt*`
with entropy debugging in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-9.patch: tests: Add basic coverage to
`XML_SetHashSalt16Bytes` in expat/tests/basic_tests.c.
- debian/patches/CVE-2026-41080-10.patch: doc: Document `XML_SetHashSalt` as
being deprecated in expat/lib/expat.h, expat/lib/xmlparse.c.
- debian/patches/CVE-2026-41080-11.patch: cmake|windows: add missing export
for new XML_SetHashSalt16Bytes in expat/lib/libexpat.def.cmake.
- CVE-2026-41080
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56408.patch: lib: Waterproof `copyString` from
integer overflow in expat/lib/xmlparse.c.
- CVE-2026-56408
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56403-1.patch: lib: Protect function `storeAtts`
from signed integer overflow in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-56403-2.patch: xmlwf: Protect function `xcsdup`
from signed integer overflow in expat/xmlwf/xmlwf.c.
- CVE-2026-56403
* SECURITY UPDATE: use after free
- debian/patches/CVE-2026-50219-1.patch: lib: Introduce handler call depth
tracking in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-2.patch: lib: Prepare
`m_notStandaloneHandler` calls for upcoming wrapping in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-3.patch: lib: Prepare
`m_externalEntityRefHandler` calls for upcoming wrapping in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-4.patch: lib: Prepare
`m_unknownEncodingHandler` calls for upcoming wrapping in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-5.patch: lib: Register
`m_attlistDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-6.patch: lib: Register
`m_characterDataHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-7.patch: lib: Register `m_commentHandler`
with handler call depth tracking in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-8.patch: lib: Register `m_defaultHandler`
with handler call depth tracking in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-9.patch: lib: Register
`m_elementDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-10.patch: lib: Register
`m_endCdataSectionHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-11.patch: lib: Register
`m_endDoctypeDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-12.patch: lib: Register
`m_endElementHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-13.patch: lib: Register
`m_endNamespaceDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-14.patch: lib: Register
`m_entityDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-15.patch: lib: Register
`m_externalEntityRefHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-16.patch: lib: Register
`m_notationDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-17.patch: lib: Register
`m_notStandaloneHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-18.patch: lib: Register
`m_processingInstructionHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-19.patch: lib: Register
`m_skippedEntityHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-20.patch: lib: Register
`m_startCdataSectionHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-21.patch: lib: Register
`m_startDoctypeDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-22.patch: lib: Register
`m_startElementHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-23.patch: lib: Register
`m_startNamespaceDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-24.patch: lib: Register
`m_unknownEncodingHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-25.patch: lib: Register
`m_unparsedEntityDeclHandler` with handler call depth tracking in
expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-26.patch: lib: Register `m_xmlDeclHandler`
with handler call depth tracking in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-27.patch: lib: Protect `XML_GetBuffer` from
being called from a handler in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-28.patch: lib: Protect `XML_Parse` from
being called from a handler in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-29.patch: lib: Protect `XML_ParseBuffer`
from being called from a handler in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-30.patch: lib: Protect `XML_ParserFree` from
being called from a handler in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-31.patch: lib: Protect `XML_ParserReset`
from being called from a handler in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-50219-32.patch: tests: Cover calls forbidden from
handlers in expat/tests/handlers.c, expat/tests/handlers.h,
expat/tests/misc_tests.c.
- CVE-2026-50219
* SECURITY UPDATE: use after free (fix for CVE-2026-50219 was incomplete)
- debian/patches/CVE-2026-56412.patch: lib: guard XML_TOK_DATA_CHARS handler
calls in doCdataSection() in expat/lib/xmlparse.c.
- CVE-2026-56412
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56404.patch: lib: protect function addBinding from
signed integer overflow in expat/lib/xmlparse.c.
- CVE-2026-56404
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-56405.patch: lib: Protect function getAttributeId
from signed integer overflow in expat/lib/xmlparse.c.
- CVE-2026-56405
-- Isabel Garcia Contreras <isabel.garcia@canonical.com> Wed, 09 Sep 2026 10:49:36 -0400
libglib2.0-0t64 (built from glib2.0) updated from 2.88.0-1 to 2.88.0-1ubuntu0.1:
glib2.0 (2.88.0-1ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: off-by-one OOB read in GVariant serialiser
- debian/patches/CVE-2026-58010.patch: fix bounds check to use >= instead
of > in gvs_tuple_is_normal() in glib/gvariant-serialiser.c.
- CVE-2026-58010
* SECURITY UPDATE: OOB read in GDateTime
- debian/patches/CVE-2026-58011.patch: add missing range validation to
g_date_time_add_full() in glib/gdatetime.c.
- CVE-2026-58011
* SECURITY UPDATE: buffer over-read in g_regex_replace
- debian/patches/CVE-2026-58012.patch: fix case-change substitution
handling with G_REGEX_RAW in glib/gregex.c.
- CVE-2026-58012
* SECURITY UPDATE: buffer over-read in GIOChannel
- debian/patches/CVE-2026-58013.patch: add length check before memcmp
in g_io_channel_read_line_backend() in glib/giochannel.c.
- CVE-2026-58013
* SECURITY UPDATE: off-by-one heap under-read in GKeyFile
- debian/patches/CVE-2026-58014.patch: add len > 0 check before
accessing value[len-1] in g_key_file_get_locale_string_list() in
glib/gkeyfile.c.
- CVE-2026-58014
* SECURITY UPDATE: path traversal in DBUS_COOKIE_SHA1 auth
- debian/patches/CVE-2026-58015.patch: validate cookie_context parameter
to prevent path traversal in gio/gdbusauthmechanismsha1.c.
- CVE-2026-58015
* SECURITY UPDATE: state confusion in D-Bus introspection XML parser
- debian/patches/CVE-2026-58016.patch: fix node element nesting check
and add assertions in gio/gdbusintrospection.c.
- CVE-2026-58016
* SECURITY UPDATE: resource exhaustion in GDBus authentication
- debian/patches/CVE-2026-15588.patch: limit length of lines read from
client in gio/gdbusauth.c.
- CVE-2026-15588
* SECURITY UPDATE: heap buffer overflow in xdgmime
- debian/patches/CVE-2026-16118.patch: fix pointer arithmetic in
byte-swap routine in gio/xdgmime/xdgmimemagic.c.
- CVE-2026-16118
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Tue, 08 Sep 2026 14:07:46 -0300
libnetplan1, netplan-generator, netplan.io (built from netplan.io) updated from 1.2-1ubuntu5 to 1.2-1ubuntu5.1:
netplan.io (1.2-1ubuntu5.1) resolute; urgency=medium
* d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when
netplan exits on error (LP: #2104373)
-- Guilherme Puida Moreira <guilherme.moreira@canonical.com> Mon, 31 Aug 2026 09:23:48 -0300
libpolkit-agent-1-0, libpolkit-gobject-1-0, polkitd (built from policykit-1) updated from 127-2ubuntu1 to 127-2ubuntu1.1:
policykit-1 (127-2ubuntu1.1) resolute-security; urgency=medium
* SECURITY UPDATE: stack underflow in cookie input
- debian/patches/CVE-2026-85498.patch: Unsanitized underflow in cookie
input in src/polkitagent/polkitagenthelperprivate.c.
- CVE-2026-85498
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 11 Sep 2026 13:30:27 -0400
rust-coreutils (built from rust-coreutils) updated from 0.8.0-0ubuntu3 to 0.10.0-1ubuntu2~26.04.1:
rust-coreutils (0.10.0-1ubuntu2~26.04.1) resolute; urgency=medium
* Backport 0.10.0-1ubuntu2 to Resolute (LP: #2166202)
-- Simon Johnsson <simon.johnsson@canonical.com> Thu, 03 Sep 2026 10:01:50 +0200
rust-coreutils (0.10.0-1ubuntu2) stonking; urgency=medium
* d/p/cp-fix-symlink-target-permissions.patch: Fix an issue where cp
would alter the permissions of the source file, such as stripping the
setuid bit (LP: #2165041)
-- Simon Johnsson <simon.johnsson@canonical.com> Wed, 26 Aug 2026 16:29:49 +0200
rust-coreutils (0.10.0-1ubuntu1) stonking; urgency=medium
[ Simon Johnsson ]
* Merge with Debian unstable. Remaining changes: (LP: #2163175)
- Install libstdbuf.so: Modify d/rules to export LIBSTDBUF_DIR as to not
skip stdbuf, fix libstdbuf.so permissions, and install it in
rust-coreutils.install.
- Install hardlinks: Rename rust-coreutils.links to
rust-coreutils.hardlinks.
- Enable feat_systemd_logind: This allows commands such as who and pinky
to work correctly. Introduces libsystemd-dev as a dependency.
- Remove Build-Depends on lld: Debian added it as the preferred linker,
but some partial architectures like i386 may be missing it.
- d/rules: Fix vendored sources field creation. Debian does not have
access to dh-cargo-vendored-sources so it uses a script instead.
Change it to use dh-cargo-vendored-sources on Ubuntu instead.
- d/rules: Skip failing tests.
- Add patches:
+ build-stty
+ dd-ensure-full-writes
+ require-utility-to-be-invoked-at-matching-path
+ Tweak-release-build-profile
+ rust-vendor/glibc-2.42
+ rustix-use-libc-backend
- Remove upstream patches:
+ fix-ppc64el-baudrate.diff: Launchpad's builders instead fails on
ppc64le for this patch, the original source code is correct.
- Update vendored rust crates
- debian/control: Update XS-Vendored-Sources-Rust field
* Drop changes:
- Remove patches fixed upstream:
+ cp-respect-composite-flag
+ fix-cp-parents
+ fix-incomplete-locale-bundles
+ fix-locale-path: Debian adopted this patch.
* New changes:
- debian/patches/remove-workspace-members.patch: Remove workspace member
array to prevent dh-cargo bypassing workspace-exclude.patch. Otherwise
vendored dependencies would still think that they're part of the
workspace.
* Fixes:
- File ownership changes when a file is mv'ed by root to a different file
system (LP: #2134860)
- Failing to build images: mv resolv.conf.tmp
/build/chroot/etc/resolv.conf mv: File exists (os error 17)
(LP: #2159679)
- unaligned plus in "ls -l" output (LP: #2132368)
- git-buildpackage ftbfs on resolute-proposed due to rust coreutils
(LP: #2137580)
- env: signal flags do not understand RTMIN+n notation (LP: #2142900)
- date: width prefix in %N format specifier is ignored
( %3N, %6N always output full 9 nanosecond digits) (LP: #2150342)
- changes in behaviour of cp in coreutils-from-uutils break test case in
util-linux (LP: #2157011)
- systemd: TEST-45-TIMEDATE is flaky with rust coreutils (LP: #2157342)
[ Varun Varma ]
* debian/patches/df-statfs-fallback.patch: Add a fallback to statfs if the
mount path could not be found normally (LP: #2116290).
-- Simon Johnsson <simon.johnsson@canonical.com> Tue, 11 Aug 2026 18:06:43 +0200
rust-coreutils (0.10.0-1) unstable; urgency=medium
* New upstream release.
* Rework the source package to match the layout used by Ubuntu, so that
merging Debian into Ubuntu no longer means undoing our repack:
- Drop debian/repack.sh: the orig tarball is now the pristine GitHub tag.
- d/watch: new, fetching the upstream tag plus the translations from
uutils/coreutils-l10n as an l10n component tarball (unpacked in l10n/).
Written in the version=4 syntax because devscripts in Debian does not
support the newer "Version: 5" templates yet.
- The vendored crates move out of the orig tarball into
debian/rust-vendor/, generated by the new "debian/rules vendor" target
with cargo-vendor-filterer (tier 2, *-*-linux-gnu* only). Vendor-only
patches now have their own quilt series, debian/patches/rust-vendor/,
applied by dh_quilt_patch; Build-Depends on quilt accordingly.
- d/control: add the XS-Vendored-Sources-Rust field.
- d/README.source: document the whole workflow.
* debian/patches:
- Drop use-vendor.diff, handled by "cargo prepare-debian" now.
- Drop disable-utmp-classic.diff: utmp-classic is an OpenBSD-only target
dependency, so it is never built on Linux; only its (unused) vendored
copy remains. Ubuntu dropped the patch for the same reason.
- Replace fix-locale-path.diff by Ubuntu's fix-locale-path.patch and add
their use-l10n-translations-in-makefile.patch, the translations being
installed from l10n/ instead of src/uu/*/locales/.
- New workspace-exclude.patch, to keep debian/rust-vendor out of the
cargo workspace.
- Rebase the remaining patches on 0.10.0 and refresh the whole series
with standard -p1 headers.
* Ship debian/tldr.zip (English pages only): the pristine tarball does not
carry the tldr archive that improve-man.diff turns into the EXAMPLES
section of the manpages, and the build has no network access.
-- Sylvestre Ledru <sylvestre@debian.org> Thu, 06 Aug 2026 00:20:00 +0200
rust-coreutils (0.9.0-3) unstable; urgency=medium
* Use the debian/changelog date (via SOURCE_DATE_EPOCH) for the
generated manpage date instead of the current build date, so the
package builds reproducibly. New patch reproducible-man-date.diff.
-- Sylvestre Ledru <sylvestre@debian.org> Thu, 04 Jun 2026 11:12:51 +0200
rust-coreutils (0.9.0-2ubuntu2) stonking; urgency=medium
[ Simon Johnsson ]
* Remove lld as dependency as it is not available on i386:
- d/control: Remove Build-Depends lld
- d/rules: Change RUSTFLAGS to omit lld
* debian/patches:
- cp-respect-composite-flag: Cherry-pick fix from upstream for issue
where the -a flag is not considered recursive due to flag stripping
(LP: #2158691)
[ Varun Varma ]
* debian/patches:
- rustix-use-libc-backend: Switch rustix backend to libc to solve
the error where tools that rely on LD_PRELOAD have altered
behaviour with the default rustix backend (LP: #2160614).
-- Simon Johnsson <simon.johnsson@canonical.com> Tue, 14 Jul 2026 17:15:36 +0200
rust-coreutils (0.9.0-2ubuntu1) stonking; urgency=medium
* Merge with Debian unstable. Remaining changes: (LP: #2153168)
- Install libstdbuf.so
- Install hardlinks
- Refresh upstream patches
- Use direct GitHub tarball instead of debian/repack.sh
- d/rules:
+ Add vendoring targets
+ Build verbosely
+ Skip failing tests
- d/watch: add watch file
- d/patches:
+ Tweak-release-build-profile.patch
+ workspace-exclude.patch
+ build-stty.patch
+ require-utility-to-be-invoked-at-matching-path.patch
+ glibc-2.42.patch
+ dd-ensure-full-writes.patch
+ use-l10n-translations-in-makefile.patch
+ fix-locale-path.patch
+ fix-incomplete-locale-bundles.patch
- d/control: update XS-Vendored-Sources-Rust field
- vendor: update vendored deps
- l10n/: update translations
* Fixes:
- xattrs break ls formatting (LP: #2154338)
- ls: files are not sorted in alphabetical order when using
--group-directories-first or if LC_ALL is unset (LP: #2154042)
* Drop changes:
- d/p/tee-fix-input-with-sleep.patch: The underlying issue was fixed
upstream, so drop the patch.
* New changes:
- Enable feat_systemd_logind to fix who not showing output
(LP: #2152801, LP: #2146819, LP: #2146818)
+ d/control: Add libsystemd-dev as a dependency.
+ d/rules: Link systemd and add feat_systemd_logind to CARGOFLAGS.
- d/p/fix-cp-parents.patch: Cherry-pick fix from upstream for cp --parents
bug resulting in build failures (LP: #2155763)
- Remove unnecessary upstream patches:
+ disable-utmp-classic.diff
+ fix-locale-path.diff: Locale handling is different on Ubuntu, using
l10n (see the new fix-locale-path.patch).
+ fix-man.diff: Uncommented in the upstream series.
+ fix-ppc64el-baudrate.diff: Launchpad's builders instead fails on
ppc64le for this patch, the original source code is correct.
+ use-vendor.diff: Vendor handling is different on Ubuntu.
- Remove docs/tldr.zip from Debian upstream
- Delete locales shipped in Debian upstream under src/
- Move vendored dependencies to debian/
-- Simon Johnsson <simon.johnsson@canonical.com> Thu, 04 Jun 2026 15:54:29 +0200
rust-coreutils (0.9.0-2) unstable; urgency=medium
* Fix the i386 (32-bit) FTBFS (OOM): the test build did fat LTO +
codegen-units=1 + full debuginfo on the giant all-utils crate and ran out
of the ~3GB address space. Set CARGO_PROFILE_RELEASE_LTO=thin,
CODEGEN_UNITS=16 and DEBUG=1 via env on all 32-bit arches so every cargo
invocation honours them, replacing the sed hacks that missed the test step.
-- Sylvestre Ledru <sylvestre@debian.org> Sun, 31 May 2026 10:04:41 +0200
rust-coreutils (0.9.0-1) unstable; urgency=medium
* New upstream release
-- Sylvestre Ledru <sylvestre@debian.org> Sat, 30 May 2026 17:07:32 +0200
rust-coreutils (0.8.0-6) unstable; urgency=medium
* Fix the s390x FTBFS (150min buildd inactivity timeout). The previous
sed only disabled LTO around dh_auto_install, so the default build and
the test build still did fat LTO + codegen-units=1 + full debuginfo on
the giant all-utils crate, which is what actually timed out. Now set
CARGO_PROFILE_RELEASE_LTO=false, CODEGEN_UNITS=16 and DEBUG=1 via env so
every cargo invocation honours them.
* Skip the (non-gating) test suite on s390x: the release test build was
the step hitting the timeout (killed at "Compiling unindent").
* Use lld as the linker on every architecture when it is available, not
just on s390x: ld.lld is detected at build time (via command -v) and
-fuse-ld=lld is added when present, falling back to the default linker
otherwise. lld links the multicall binary much faster than GNU ld.
Build-Depend on lld on all architectures (it ships from the same
llvm-toolchain source as the already-required libclang-dev).
* Log the linker on every architecture: emit the -Wl,-v banner on every
link and print rustc -vV / ld.lld / ld at configure time, so every build
log records which linker ran. Previously the ld.lld check lived in
dh_auto_install (never reached when the build timed out) and only on s390x.
-- Sylvestre Ledru <sylvestre@debian.org> Thu, 28 May 2026 08:08:46 +0200
rust-coreutils (0.8.0-5) unstable; urgency=medium
* Disable LTO on s390x: thin LTO + lld in 0.8.0-4 still timed out on
the buildd, so turn LTO off entirely on s390x.
* Print ld.lld version and ask the linker to log itself (-Wl,-v) so
the build log shows which linker was actually invoked.
-- Sylvestre Ledru <sylvestre@debian.org> Wed, 27 May 2026 23:11:39 +0200
rust-coreutils (0.8.0-4) unstable; urgency=medium
* Use lld as the linker on s390x: thin LTO alone in 0.8.0-3 did not
unblock the buildd timeout, so switch the final link to ld.lld.
-- Sylvestre Ledru <sylvestre@debian.org> Wed, 27 May 2026 08:04:14 +0200
rust-coreutils (0.8.0-3) unstable; urgency=medium
* Use thin LTO on s390x to avoid linker timeouts on the buildd
-- Sylvestre Ledru <sylvestre@debian.org> Wed, 27 May 2026 08:04:14 +0200
rust-coreutils (0.8.0-2) unstable; urgency=medium
* try to unbreak the ppc64 build
-- Sylvestre Ledru <sylvestre@debian.org> Sun, 17 May 2026 14:58:46 +0200
rust-coreutils (0.8.0-1) unstable; urgency=medium
* New upstream release (Closes: #1134876)
* Improve the manpage (LP: #2115782)
* Add manpage symlink for coreutils binary (no-manual-page)
* Extend disable-utmp-classic.diff to cover the new
[target.'cfg(target_os = "openbsd")'.dependencies] block in
src/uucore/Cargo.toml introduced upstream in 0.8.0 (fixes FTBFS).
* Disable fix-man.diff: it converts .ftl bullet markers from `-` to `*`
and rewrites top-level `key = value` lines as markdown bullets, which
is invalid Fluent syntax. uudoc loads each utility's locale via
setup_localization_or_exit and was aborting manpage generation with
a Localization parse error. Patch kept in debian/patches/ but
commented out in series until it can be rewritten Fluent-cleanly.
-- Sylvestre Ledru <sylvestre@debian.org> Wed, 06 May 2026 13:08:52 +0000
libsqlite3-0 (built from sqlite3) updated from 3.46.1-9ubuntu0.2 to 3.46.1-9ubuntu0.3:
sqlite3 (3.46.1-9ubuntu0.3) resolute-security; urgency=medium
* SECURITY UPDATE: buffer overflow via integer truncation in sqlar extension
- debian/patches/CVE-2026-39113.patch: change sqlite3_value_int() to
sqlite3_value_int64() in sqlarUncompressFunc() in ext/misc/sqlar.c to
prevent 32-bit truncation of the decompressed size, which caused an
undersized buffer allocation and heap buffer overflow via uncompress().
- CVE-2026-39113
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Thu, 03 Sep 2026 11:45:25 -0300
10/09/2026, commit https://github.com/canonical/core-base/tree/b9796f239a02c61a0735ea85f8e15252b99a5bcc
[ Changes in the core26 snap ]
No detected changes for the core26 snap
[ Changes in primed packages ]
dpkg (1.23.7ubuntu1): new primed package
apparmor, libapparmor1 (built from apparmor) updated from 5.0.0~beta1-0ubuntu7 to 5.0.2-0ubuntu1~26.04.1:
apparmor (5.0.2-0ubuntu1~26.04.1) resolute; urgency=medium
* New upstream release (SRU backport). (LP: #2161458)
* Upstream release contains fixes for:
- uucore locales reads (LP: #2158941)
- lsusb uevent file reads (LP: #2158939)
- alsamixer asound config reads (LP: #2157575)
* d/apparmor.install: add the new glycin.* profiles
* d/libapparmor1.symbols: add the new library symbols
* d/rules: add profiles check to testing step
* d/watch:
- Update regex to handle -rc version numbers
- Update to version 5 of the format
* Refresh patches to apply to upstream release:
- d/p/u/profiles-grant-access-to-systemd-resolved.patch
- d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch
* Update patches to apply to upstream release:
- d/p/u/samba-systemd-interaction.patch
- d/p/u/profiles_disable_curl.patch
- d/p/u/profiles_add_more_consoles_workaround.patch
- d/p/u/profiles-use-coreutils-tunable.patch
- d/p/u/0001-parser-add-more-reserved-mediation-classes.patch
- d/p/u/0007-Set-parser-network.h-ip_conds-ptrs-to-null-in-its-fr.patch
* Drop patches that were applied upstream:
- d/p/u/libapparmor-move-aa_get_lsm_iface-decl-in-libapparmor.patch
- d/p/u/0001-parser-set-umask-before-creating-temp-file.patch
- d/p/u/0002-parser-restrict-umask-to-allow-only-user-permissions.patch
- d/p/u/libapparmor-add-test-for-libapparmor-features-prefix.patch
- d/p/u/transmission-common-fixes-for-lp-2137395.patch
- d/p/u/unix-chkpwd-add-disconnected-run-paths.patch
- d/p/u/profiles-add-extensions-to-allowed-ghostscript.patch
- d/p/u/profiles-expand-the-allowed-directories-for-ghostscript.patch
- d/p/u/profiles-add-sys-kernel-mm-transparent_hugepage-enable.patch
- d/p/u/0006-parser-name-ns_domain-and-network_v9-classes.patch
- d/p/u/0011-utils-add-support-for-iface-an-label-in-network-rule.patch
- d/p/u/0013-parser-fix-FTBFS-due-to-missing-merge-edit.patch
- d/p/u/0014-tests-check-if-skb-mediation-is-enabled.patch
- d/p/u/snap-browser-add-missing-perms-when-opening-from-link.patch
- d/p/u/lsusb-allow-reading-etc-udev-hwdb-bin.patch
- d/p/u/profiles-grant-unix-domain-socket-access-to-sanitize.patch
- d/p/u/0002-parser-refactor-compressed-policy-cache.patch
- d/p/u/0003-parser-handle-compressed-cache-on-kernels-without-de.patch
- d/p/u/0004-regression-fix-the-e2e-test-for-compressed-caches.patch
* Drop patches that were superseded upstream:
- d/p/u/0002-parser-convert-conditionals-operators-to-an-enum.patch
- d/p/u/0003-parser-add-override-assign-to-cond-list-elements.patch
- d/p/u/0004-parser-support-network-interface-conditional.patch
- d/p/u/0005-tests-add-network-interface-tests.patch
- d/p/u/0008-parser-move-to-encode-an-alternation-of-a-null-trans.patch
- d/p/u/0009-parser-disable-ability-to-specify-interface-on-peer-.patch
- d/p/u/0010-parser-fix-iface-perms-to-work-when-v9-and-v9_skb-ar.patch
- d/p/u/0012-parser-fix-label-match-for-default-label-values.patch
- d/p/u/0001-parser-fix-rewriting-of-cache-after-zstd-recompressi.patch
* Add patches to fix FTBFS (profile test enabling):
- d/p/u/profiles-allow-more-attach-disconnected.patch
* Update patches to fix FTBFS (profile test enabling):
- d/p/u/openvpn_mr_1263.patch
- d/p/u/irssi_mr_1332.patch
- d/p/u/os_prober_mr_1569.patch
- d/p/u/profiles_disable_free.patch
- d/p/u/profiles_disable_curl.patch
- d/p/u/profiles-tunables-add-coreutils-var.patch
- d/p/u/profiles-use-coreutils-tunable.patch
- d/p/u/profiles-pull-openvpn-profile.patch
* Add patch to fix transmission-gtk file chooser (LP: #2152079):
- d/p/u/profiles-add-file-chooser-rules-to-abstractions-trans.patch
-- Ryan Lee <ryan.lee@canonical.com> Mon, 13 Jul 2026 10:43:46 -0700
libattr1 (built from attr) updated from 1:2.5.2-4 to 1:2.5.2-4ubuntu0.1:
attr (1:2.5.2-4ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: Symlink Traversal
- d/p/upstream/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add
visibility attribute header in include/Makemodule.am, include/visibility-
hidden.h.
- d/p/upstream/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add
xattrat syscall wrappers in configure.ac, include/Makemodule.am,
include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.
- d/p/upstream/CVE-2026-54371-03-add-xattrat-syscall-backwards-
compatibility-code.patch: Add xattrat syscall backwards compatibility code
in include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,
libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-
self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,
libmisc/setxattrat_compat.c.
- d/p/upstream/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch:
Rename walk_tree to old_walk_tree in include/Makemodule.am,
include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,
tools/getfattr.c.
- d/p/upstream/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the
new walk_tree helper in include/Makemodule.am, include/walk_tree.h,
libmisc/Makemodule.am, libmisc/walk_tree.c.
- debian/patches/upstream/CVE-2026-54371-06-harden-getfattr.patch: harden
getfattr in man/man1/getfattr.1, tools/getfattr.c,
test/root/getfattr.test.
- d/p/upstream/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-
buffer.patch: setfattr: multiple --restore accesses freed buffer in
tools/setfattr.c.
- d/p/upstream/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-
after-restore.patch: setfattr: Do not ignore --no-dereference after
--restore in tools/setfattr.c.
- d/p/upstream/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add
openat2 syscall wrapper in configure.ac, include/Makemodule.am,
include/openat2.h, libmisc/Makemodule.am, libmisc/openat2.c.
- d/p/upstream/CVE-2026-54371-10-harden-setfattr-restore.patch: harden
setfattr --restore in configure.ac, man/man1/setfattr.1,
test/Makemodule.am, tools/setfattr.c, test/restore.test.
- CVE-2026-54371
-- John Breton <john.breton@canonical.com> Sun, 23 Aug 2026 21:34:50 -0400
libaudit-common, libaudit1 (built from audit) updated from 1:4.1.2-1build1 to 1:4.1.2-1ubuntu0.1:
audit (1:4.1.2-1ubuntu0.1) resolute; urgency=medium
* Fix AppArmor AVC events not appearing in `ausearch` (LP: #1117804)
- d/p/lp1117804-audit-ausearch-do-not-require-tclass.patch
-- Alex Ramírez <alex.ramirez@canonical.com> Mon, 13 Jul 2026 20:33:31 +0000
base-files (built from base-files) updated from 14ubuntu6.1 to 14ubuntu6.2:
base-files (14ubuntu6.2) resolute; urgency=medium
* /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 26.04.1
(LP: #2164885)
-- Oliver Reiche <oliver.reiche@canonical.com> Mon, 24 Aug 2026 12:33:48 +0200
bzip2, libbz2-1.0 (built from bzip2) updated from 1.0.8-6build2 to 1.0.8-6ubuntu0.1:
bzip2 (1.0.8-6ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: out-of-bounds write
- debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not
process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.
- CVE-2026-42250
-- Shishir Subedi <shishir.subedi@canonical.com> Thu, 27 Aug 2026 09:49:34 +0545
gnu-coreutils (built from coreutils) updated from 9.7-3ubuntu2 to 9.7-3ubuntu2.1:
coreutils (9.7-3ubuntu2.1) resolute-security; urgency=medium
* SECURITY UPDATE: out-of-bounds read in sort
- debian/patches/CVE-2025-5278.patch: sort: fix buffer under-read in
src/sort.c, tests/local.mk, tests/sort/sort-field-limit.sh,
Makefile.in.
- CVE-2025-5278
* SECURITY UPDATE: out‑of‑bounds read in uniq
- debian/patches/CVE-2026-56391.patch: uniq: fix read overrun with -w in
src/uniq.c, tests/uniq/uniq.pl.
- CVE-2026-56391
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 25 Aug 2026 11:07:27 -0400
diffutils (built from diffutils) updated from 1:3.12-1 to 1:3.12-1ubuntu0.1:
diffutils (1:3.12-1ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: Integer Overflow
- debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows
when reading line numbers from diff in NEWS, THANKS, src/diff3.c.
- debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line
offsets in src/diff3.c.
- CVE-2026-53910
-- John Breton <john.breton@canonical.com> Wed, 26 Aug 2026 14:14:58 -0400
distro-info-data (built from distro-info-data) updated from 0.68ubuntu0.1 to 0.72-0ubuntu0.26.04.1:
distro-info-data (0.72-0ubuntu0.26.04.1) resolute; urgency=medium
* New data update release
- Ubuntu Legacy Support extension has been increased to 15 years
(LP: #2131678)
* Convert source package from a native package to an upstream package to
make it easier to track differences in the data versus in the packaging.
-- Benjamin Drung <bdrung@ubuntu.com> Tue, 14 Jul 2026 12:47:46 +0200
libfreetype6 (built from freetype) updated from 2.14.2+dfsg-1 to 2.14.2+dfsg-1ubuntu0.1:
freetype (2.14.2+dfsg-1ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: OOB read in TT_Get_Var_Design implementation
- debian/patches/CVE-2026-50811-1.patch: Zero extras in
src/truetype/ttgxvar.c.
- debian/patches/CVE-2026-50811-2.patch: Updated in src/type1/t1load.c.
- CVE-2026-50811
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 16 Jul 2026 10:53:19 -0400
libc-bin, libc6, locales (built from glibc) updated from 2.43-2ubuntu2 to 2.43-2ubuntu2.4:
glibc (2.43-2ubuntu2.4) resolute-security; urgency=medium
* SECURITY UPDATE: Buffer overflow in strfmon right-justification padding
- debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in
strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,
stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.
- CVE-2026-19499
* SECURITY UPDATE: Out-of-bounds stack array access in tdelete
- debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write
in tdelete (bug 34506) in misc/tsearch.c.
- CVE-2026-19542
* SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND
- debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to
preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in
posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.
- CVE-2026-6368
* SECURITY UPDATE: stack clash issue when expanding long tilde paths
- debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp
tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-
wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-
wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-
tilde.root/etc/passwd, posix/wordexp.c.
- CVE-2026-6791
* SECURITY UPDATE: SHIFT_JISX0213 converter hang
- debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding
lacks pending character reset (CVE-2026-77117) in
iconvdata/shift_jisx0213.c.
- debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,
bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.
- CVE-2026-77117
* SECURITY UPDATE: EUC_JISX0213 converter hang
- debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding
lacks pending character reset (CVE-2026-80489) in iconvdata/euc-
jisx0213.c.
- CVE-2026-80489
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 03 Sep 2026 10:09:39 -0400
glibc (2.43-2ubuntu2.3) resolute-security; urgency=medium
* SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets
- debian/patches/CVE-2026-4046.patch: Use pending character state in
IBM1390, IBM1399 character sets in iconvdata/Makefile,
iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.
- CVE-2026-4046
* SECURITY UPDATE: out-of-bounds write in deprecated debugging function
- debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in
ns_sprintrrf in resolv/ns_print.c.
- CVE-2026-5435
* SECURITY UPDATE: one byte heap buffer overflow in scanf %mc
- debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in
scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-
bz34008.c, stdio-common/vfscanf-internal.c.
- CVE-2026-5450
* SECURITY UPDATE: crash or info disclosure in ungetwc function
- debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte
stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.
- CVE-2026-5928
* SECURITY UPDATE: crash in deprecated debugging functions
- debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,
__p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.
- debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf
formatting of class, type values in resolv/ns_print.c.
- debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of
unknown records in ns_sprintrrf in resolv/ns_print.c.
- debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop
failure in ns_sprintrrf in resolv/ns_print.c.
- debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in
ns_sprintrrf in resolv/ns_print.c.
- debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-
ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.
- CVE-2026-6238
* Disable failing tests because of rust-coreutils (LP: 2161727)
- debian/testsuite-xfail-debian.mk: added tst-spawn-chdir and
tst-spawn-chdir-pidfd.
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 22 Jul 2026 13:24:47 -0400
gpgv (built from gnupg2) updated from 2.4.8-4ubuntu3 to 2.4.8-4ubuntu3.1:
gnupg2 (2.4.8-4ubuntu3.1) resolute-security; urgency=medium
* SECURITY UPDATE: Improper Input Validation
- debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length
for GCM decryption. in sm/decrypt.c.
- CVE-2026-57062
-- John Breton <john.breton@canonical.com> Wed, 02 Sep 2026 15:38:37 -0400
gzip (built from gzip) updated from 1.14-1~exp2ubuntu1 to 1.14-1~exp2ubuntu1.1:
gzip (1.14-1~exp2ubuntu1.1) resolute-security; urgency=medium
* SECURITY UPDATE: insecure temp file handling
- debian/patches/CVE-2026-41991.patch: gzexe: use -C if lacking mktemp in
gzexe.in, zdiff.in.
- CVE-2026-41991
* SECURITY UPDATE: overflow in LZH decompression logic
- debian/patches/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z
in unlzh.c.
- CVE-2026-41992
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 03 Jul 2026 07:51:25 -0400
iproute2 (built from iproute2) updated from 6.19.0-1ubuntu1 to 6.19.0-1ubuntu1.1:
iproute2 (6.19.0-1ubuntu1.1) resolute; urgency=medium
* Modify tc/tbf and tc/htb to allow 64 bit burst parameter (LP: #2147525)
- /d/p/lp2147525-1-tc-tbf-enable-64-bit-burst.patch
- /d/p/lp2147525-2-tc-htb-enable-64-bit-burst.patch
-- Ioana Lazea <ioana.lazea@canonical.com> Thu, 09 Apr 2026 11:47:09 +0300
libgssapi-krb5-2, libk5crypto3, libkrb5-3, libkrb5support0 (built from krb5) updated from 1.22.1-2ubuntu4 to 1.22.1-2ubuntu4.1:
krb5 (1.22.1-2ubuntu4.1) resolute-security; urgency=medium
* SECURITY UPDATE: nteger underflow berval2tl_data()
- debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap
in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.
- CVE-2026-11850
* SECURITY UPDATE: security issues in the NegoEx mechanism
- debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing
vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.
- CVE-2026-40355
- CVE-2026-40356
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 15 Jul 2026 14:22:56 -0400
libgcrypt20 (built from libgcrypt20) updated from 1.12.0-2ubuntu0.1 to 1.12.0-2ubuntu1.1:
libgcrypt20 (1.12.0-2ubuntu1.1) resolute-security; urgency=medium
* SECURITY UPDATE: timing-based side-channel flaw in RSA implementation
- debian/patches/CVE-2024-2236-1.patch: rsa: Do not accept invalid PKCS#1.5
padding when deciphering in cipher/rsa-common.c, src/const-time.h.
- debian/patches/CVE-2024-2236-2.patch: rsa: Constant time blinding removal
in cipher/rsa.c, configure.ac, mpi/Makefile.am, mpi/mpi-internal.h,
mpi/mpi-mul-cs.c, mpi/mpi-mul.c, src/gcrypt-int.h.
- debian/patches/CVE-2024-2236-3.patch: Constant time conversion of the
message to the SEXP in cipher/rsa.c, src/const-time.c, src/const-time.h,
src/sexp.c.
- debian/patches/CVE-2024-2236-4.patch: rsa: Implement constant-time
conversion of MPI to string in cipher/rsa-common.c.
- debian/patches/CVE-2024-2236-5.patch: cipher: Use the constant time
conversion also for OAEP in cipher/rsa-common.c, cipher/rsa.c.
- debian/patches/CVE-2024-2236-6.patch: Implement implicit rejection for
PKCS#1.5 decipher in cipher/pubkey-internal.h, cipher/pubkey-util.c,
cipher/rsa-common.c, cipher/rsa.c, src/cipher.h, src/const-time.h,
tests/pkcs1v2-v15c.h, tests/pkcs1v2.c.
- debian/rules: build with --enable-marvin-workaround.
- Thanks for Red Hat for the patches!
- CVE-2024-2236
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 24 Aug 2026 13:54:07 -0400
libgcrypt20 (1.12.0-2ubuntu1) resolute; urgency=medium
* d/p/riscv-fix-vlen-greater-128: Fix computing on RISC-V
with VLEN > 128 (LP: #2154120)
-- Valentin Haudiquet <valentin.haudiquet@canonical.com> Fri, 29 May 2026 14:01:44 +0200
libpciaccess0 (built from libpciaccess) updated from 0.18.1-1ubuntu4 to 0.18.1-1ubuntu4.1:
libpciaccess (0.18.1-1ubuntu4.1) resolute; urgency=medium
* d/rules: correct pc.ids path (LP: #2145797)
-- Hector Cao <hector.cao@canonical.com> Thu, 02 Jul 2026 12:57:29 +0200
nvidia-kernel-common-595 (built from nvidia-graphics-drivers-595) updated from 595.71.05-0ubuntu0.26.04.1 to 595.91.07-0ubuntu0.26.04.1:
nvidia-graphics-drivers-595 (595.91.07-0ubuntu0.26.04.1) resolute; urgency=medium
* New upstream version 595.91.07 (LP: #2163130)
-- Abdur Rahman <abdur.rahman@canonical.com> Sun, 09 Aug 2026 19:13:46 -0400
nvidia-graphics-drivers-595 (595.84-0ubuntu0.26.04.1) resolute; urgency=medium
* New upstream version 595.84 (LP: #2158653)
* dkms: Drop thunk-Kbuild.patch
-- Noah Wager <noah.wager@canonical.com> Mon, 29 Jun 2026 10:28:04 -0700
openssh-client, openssh-server, openssh-sftp-server (built from openssh) updated from 1:10.2p1-2ubuntu3.2 to 1:10.2p1-2ubuntu3.6:
openssh (1:10.2p1-2ubuntu3.6) resolute-security; urgency=medium
* SECURITY UPDATE: misinteraction between agent locking and the
session-bind@openssh.com extension
- debian/patches/CVE-2026-73281.patch: upstream: Allow session-
bind@openssh.com requests when the agent is in ssh-agent.c.
- CVE-2026-73281
* SECURITY UPDATE: se-after-free for realloc data
- debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc
use-after-free in the client if a in ssh.c.
- CVE-2026-73282
* SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding
- debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys
"restrict" keyword apply correctly in serverloop.c.
- CVE-2026-73283
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 31 Aug 2026 14:36:25 -0400
openssh (1:10.2p1-2ubuntu3.5) resolute-security; urgency=medium
* No-change rebuild against new build-essential to get libcrypt-dev
installed during build. (LP: #2161162)
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Sat, 18 Jul 2026 12:04:58 -0400
openssh (1:10.2p1-2ubuntu3.4) resolute-security; urgency=medium
* SECURITY UPDATE: sftp downloaded files location issue
- debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-
controlled path when performing in sftp.c.
- CVE-2026-59995
* SECURITY UPDATE: scp parent directory issue
- debian/patches/CVE-2026-59996.patch: upstream: resist that return ".." via
remote glob during in scp.c.
- CVE-2026-59996
* SECURITY UPDATE: internal-sftp ignores more than 9 commandline args
- debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline
arguments to the internal-sftp server, in session.c.
- CVE-2026-59997
* SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour
- debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding
GSSAPIStrictAcceptorCheck in in sshd_config.5.
- CVE-2026-59998
* SECURITY UPDATE: DisableForwarding=yes not taking proper precedence
- debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes
didn't override PermitTunnel=yes in serverloop.c.
- CVE-2026-59999
* SECURITY UPDATE: DoS via MaxAuthTries mishandling
- debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462
(GSSAPIAuthentication) compliance in auth2-gss.c.
- debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in
auth2-gss.c.
- CVE-2026-60000
* SECURITY UPDATE: minimum authentication delay not always honoured
- debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and
keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.
- CVE-2026-60001
* SECURITY UPDATE: Use-after-free during a key re-exchange
- debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime
of several bits of client in ssh.c, sshconnect.c, sshconnect.h,
sshconnect2.c.
- CVE-2026-60002
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 09 Jul 2026 14:06:35 -0400
openssh (1:10.2p1-2ubuntu3.3) resolute; urgency=medium
* d/p/lp2151817-fix-pam-short-names-{1,2}.patch:
- Cherry-pick upstream patch to fix PAM with short names (LP: #2151817)
-- Grayson Wolf <grayson.wolf@canonical.com> Tue, 09 Jun 2026 16:33:11 -0400
libssl3t64, openssl, openssl-provider-legacy (built from openssl) updated from 3.5.5-1ubuntu3.2 to 3.5.5-1ubuntu3.5:
openssl (3.5.5-1ubuntu3.5) resolute-security; urgency=medium
* SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using
EVP_Cipher()
- debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()
finalize: Poly1305 and OCB AEADs in
providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,
providers/implementations/ciphers/cipher_aes_ocb.c,
providers/implementations/ciphers/cipher_chacha20_poly1305.c.
- debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD
EVP_Cipher() finalization in test/evp_extra_test.c.
- CVE-2026-75803
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 26 Aug 2026 07:58:23 -0400
openssl (3.5.5-1ubuntu3.4) resolute-security; urgency=medium
* SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel
Queue
- debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending
QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,
include/internal/quic_port.h, include/openssl/ssl.h.in,
ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,
util/other.syms.
- CVE-2026-14456
* SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference
a Missing Certificate
- debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert
extension in key-only context in ssl/t1_lib.c, test/rpktest.c.
- CVE-2026-14457
* SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing
INITIAL Packet
- debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from
port_default_packet_handler in include/internal/quic_channel.h,
ssl/quic/quic_channel.c, ssl/quic/quic_port.c.
- debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in
port_default_packet_handler() in include/internal/quic_record_rx.h,
ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.
- CVE-2026-18798
* SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future
Epoch
- debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation
when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.
- debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:
lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.
- debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS
processed_rcds record queue in ssl/record/methods/dtls_meth.c,
ssl/record/methods/recmethod_local.h.
- CVE-2026-54874
* SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping
- debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in
test/cmsapitest.c, test/recipes/80-test_cmsapi.t.
- debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte
OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.
- CVE-2026-63072
* SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response
Validation
- debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as
format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.
- debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in
test/cmp_vfy_test.c.
- CVE-2026-63073
* SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts
- debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth
in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,
test/recipes/65-test_cmp_msg.t.
- debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in
cmp in crypto/cmp/cmp_vfy.c.
- CVE-2026-63074
* SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
- debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX
history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,
ssl/quic/quic_txp.c.
- CVE-2026-63075
* SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted
protectionAlg
- debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in
test/cmp_protect_test.c.
- debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in
ossl_cmp_calc_protection() via crafted protectionAlg in
crypto/cmp/cmp_protect.c.
- CVE-2026-63076
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 18 Aug 2026 07:56:34 -0400
openssl (3.5.5-1ubuntu3.3) resolute-security; urgency=medium
* SECURITY UPDATE: HollowByte Denial of Service issue (LP: #2161371)
- debian/patches/lp2161371.patch: Grow the init_buf incrementally as we
receive data in ssl/statem/statem.c, ssl/statem/statem_lib.c.
- No CVE number
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 29 Jul 2026 12:50:53 -0400
libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g (built from pam) updated from 1.7.0-5ubuntu3 to 1.7.0-5ubuntu3.2:
pam (1.7.0-5ubuntu3.2) resolute-security; urgency=medium
* SECURITY UPDATE: account lockout bypass in pam_faillock account
management phase (LP: #2164901)
- debian/patches/lp-2164901.patch: skip clearing user's failed
attempt in modules/pam_faillock/pam_faillock.8.xml,
modules/pam_faillock/pam_faillock.c.
- No CVE number
-- Shafayat Hossain Majumder <shafayat.majumder@canonical.com> Wed, 26 Aug 2026 15:28:39 -0400
pam (1.7.0-5ubuntu3.1) resolute-security; urgency=medium
* SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb
module string comparisons
- debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison
timing leak in libpam/include/pam_inline.h,
modules/pam_userdb/pam_userdb.c.
- CVE-2026-54411
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 16 Jul 2026 09:34:12 -0400
sudo-rs (built from rust-sudo-rs) updated from 0.2.13-0ubuntu1 to 0.2.13-0ubuntu1.2:
rust-sudo-rs (0.2.13-0ubuntu1.2) resolute-security; urgency=medium
* d/patches/fix-sudoedit.patch: Fix privilege escalation race in sudoedit
(LP: #2165142)
-- Simon Johnsson <simon.johnsson@canonical.com> Thu, 27 Aug 2026 10:15:26 +0200
rust-sudo-rs (0.2.13-0ubuntu1.1) resolute; urgency=medium
* Backport upstream patches:
- flexible-array-sizes-for-groups: Fix an error where sudo would fail on
large groups (LP: #2158541)
- improve-res-set-valid-pam-tty: Fix wrongly computed PAM_TTY
(LP: #2153817)
-- Simon Johnsson <simon.johnsson@canonical.com> Thu, 09 Jul 2026 09:35:34 +0200
libsqlite3-0 (built from sqlite3) updated from 3.46.1-9 to 3.46.1-9ubuntu0.2:
sqlite3 (3.46.1-9ubuntu0.2) resolute-security; urgency=medium
* SECURITY UPDATE: NULL pointer dereference in the SQLite Session Extension
- debian/patches/CVE-2026-50812.patch: Fix a bug causing the session module
to dereference a NULL pointer when applying a corrupt changeset. in
ext/session/session9.test, ext/session/sqlite3session.c.
- CVE-2026-50812
* SECURITY UPDATE: sensitive information disclosure via the Session Extension
- debian/patches/CVE-2026-50813.patch: Fix a buffer overread in the session
module that could occur when processing a corrupt changeset. in
ext/session/sessionC.test, ext/session/sqlite3session.c.
- CVE-2026-50813
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 16 Jul 2026 13:08:01 -0400
sqlite3 (3.46.1-9ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: security issues in FTS5 full-text search
- debian/patches/CVE-2026-11822_4.patch: Fix logic in ext/fts5/fts5_index.c.
- CVE-2026-11822
- CVE-2026-11824
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 16 Jun 2026 13:48:21 -0400
libpam-systemd, libsystemd-shared, libsystemd0, libudev1, systemd, systemd-coredump, systemd-cryptsetup, systemd-dev, systemd-resolved, systemd-sysv, systemd-timesyncd, udev (built from systemd) updated from 259.5-0ubuntu3 to 259.5-0ubuntu3.4:
systemd (259.5-0ubuntu3.4) resolute-security; urgency=medium
* SECURITY UPDATE: systemd-homed: local privilege escalation via missing
home-record signature verification on the authenticate path
- homed-fix-verification-of-local-identity-file.patch
- homed-verify-privileged-worker-changes.patch
- CVE-2026-16742
* SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary
processes
- CVE-2026-15059.patch
- CVE-2026-15059
* SECURITY UPDATE: systemd-machined: unprivileged users can terminate
arbitrary processes
- CVE-2026-15060.patch
- CVE-2026-15060
* SECURITY UPDATE: systemd: crash triggered by unprivileged users in various
components via Varlink
- GHSA-5rm9-cc37-35gq.patch
- GHSA-5rm9-cc37-35gq
* SECURITY UPDATE: udev: local root execution via malicious iscsi devices
and unsanitized kernel output
- GHSA-m8q3-73v4-wvg7.patch
- GHSA-m8q3-73v4-wvg7
* SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure
via systemd-machined
- GHSA-2p9f-rcmv-x36h.patch
- GHSA-2p9f-rcmv-x36h
* SECURITY UPDATE: crash triggered by unprivileged users in various
components via D-Bus/Varlink
- core-limit-the-number-of-units-that-can-be-requested-over.patch
- dbus-limit-the-number-of-env-variables-to-something-reaso.patch
- dbus-manager-limit-the-number-of-states-patterns-per-quer.patch
- dns-question-limit-the-number-of-questions-per-query.patch
- resolve-enforce-the-search-domain-limit-earlier.patch
- resolve-limit-the-number-NTAs-to-something-sensible.patch
- sd-bus-store-the-strv-size-when-extending-it.patch
- sd-json-limit-the-number-of-env-variables-to-something-re.patch
- sd-json-user-record-store-the-strv-size-when-extending-it.patch
- GHSA-3jgj-3phh-hx5j
-- Nick Rosbrook <enr0n@ubuntu.com> Mon, 27 Jul 2026 16:44:02 -0400
systemd (259.5-0ubuntu3.3) resolute; urgency=medium
* d/systemd.postinst: move systemd-tmpfiles --create after debhelper.
Otherwise, the debhelper-generated systemd-tmpfiles call will include
var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when
the systemd package is upgraded. (LP: #2158686)
-- Nick Rosbrook <enr0n@ubuntu.com> Wed, 22 Jul 2026 13:07:19 -0400
systemd (259.5-0ubuntu3.2) resolute; urgency=medium
* test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)
* d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts
(LP: #2157344)
-- Nick Rosbrook <enr0n@ubuntu.com> Thu, 18 Jun 2026 10:27:05 -0400
systemd (259.5-0ubuntu3.1) resolute; urgency=medium
* Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)
- units: order networkd resolve hook After=network-pre.target
- units: drop Before=sockets.target from networkd resolve hook
* core: Open netfilter socket only when needed (LP: #2150773)
* mkosi: trim verity.sig json files to remove NUL padding before passing to jq
(LP: #2155132)
-- Nick Rosbrook <enr0n@ubuntu.com> Tue, 09 Jun 2026 08:59:25 -0400
tar (built from tar) updated from 1.35+dfsg-4ubuntu0.1 to 1.35+dfsg-4ubuntu0.4:
tar (1.35+dfsg-4ubuntu0.4) resolute-security; urgency=medium
* SECURITY REGRESSION: Old archives with nonzero directory sizes
failing to be extracted
- debian/patches/CVE-2026-5704-5.patch: fix this by forcing
the size to zero for DIRTYPE in read_header() in src/list.c
(LP: #2161311)
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Mon, 20 Jul 2026 10:45:02 -0300
tar (1.35+dfsg-4ubuntu0.3) resolute-security; urgency=medium
* SECURITY REGRESSION: Extract files issue
- debian/patches/CVE-2026-5704-*.patch: address a regression
that makes valid files not extract in src/list.c,
tests/Makefile.am, tests/extrac32.at, tests/extrac34.at,
test/testsuite.at, src/extract.c, tests/extract23,
tests/extrac30.at (LP: #2160650).
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Wed, 15 Jul 2026 08:59:43 -0300
tar (1.35+dfsg-4ubuntu0.2) resolute-security; urgency=medium
* SECURITY UPDATE: File overwrite via directory traversal
- debian/patches/CVE-2025-45582-*.patch: Backport openat2 support in
order to jailify the extraction directory.
- CVE-2025-45582
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Sat, 27 Jun 2026 19:09:16 -0400
tzdata (built from tzdata) updated from 2026a-3ubuntu1 to 2026c-0ubuntu0.26.04.1:
tzdata (2026c-0ubuntu0.26.04.1) resolute; urgency=medium
* New upstream release (LP: #2161092):
- Alberta moved to permanent -06 on 2026-06-18, so it will not fall back
from -06 to -07 on 2026-11-01.
- Morocco moves to permanent +00 on 2026-09-20.
* Add autopkgtest test case for 2026c release
* Update the ICU timezone data to 2026c
* Add autopkgtest test case for ICU timezone data 2026c
-- Benjamin Drung <bdrung@ubuntu.com> Fri, 17 Jul 2026 14:43:50 +0200
tzdata (2026b-0ubuntu0.26.04.1) resolute; urgency=medium
* New upstream release (LP: #2157973):
- British Columbia moved to permanent -07 on 2026-03-09, so it will not
fall back from -07 to -08 on 2026-11-01.
* Add autopkgtest test case for 2026b release
* Update the ICU timezone data to 2026b
* Add autopkgtest test case for ICU timezone data 2026b
-- Benjamin Drung <bdrung@ubuntu.com> Tue, 23 Jun 2026 14:07:59 +0200
fdisk, libblkid1, libfdisk1, liblastlog2-2, libmount1, libsmartcols1, libuuid1, login, mount, rfkill, util-linux, util-linux-extra (built from util-linux) updated from 2.41.3-3ubuntu2 to 2.41.3-3ubuntu2.2:
util-linux (2.41.3-3ubuntu2.2) resolute-security; urgency=medium
* SECURITY UPDATE: Heap use-after-free via crafted block device image
- debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in
nested partition probing in libblkid/src/partitions/partitions.c.
- CVE-2026-13595
* SECURITY UPDATE: TOCTOU in mount utility
- debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to
prevent symlink attacks in include/loopdev.h, lib/loopdev.c,
libmount/src/hook_loopdev.c.
- CVE-2026-27456
* SECURITY UPDATE: Improper hostname canonicalization in login
- debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST
in login-utils/login.c.
- CVE-2026-3184
* SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount
- debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod
in hook_owner in libmount/src/hook_owner.c.
- CVE-2026-53612
* SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount
- debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add
ul_open_no_symlinks() in configure.ac, include/fileutils.h,
lib/fileutils.c, meson.build.
- debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context
for TOCTOU prevention in libmount/src/context.c,
libmount/src/context_mount.c, libmount/src/hook_mount.c,
libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.
- CVE-2026-53613
* SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2
Environment Variable
- debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via
LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,
libmount/src/hook_mount_legacy.c.
- CVE-2026-53614
* SECURITY UPDATE: Integer Overflow or Wraparound in dos.c
- debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and
links within extended partition in libblkid/src/partitions/dos.c.
- CVE-2026-53615
* debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:
fix ftbfs on arm64 and armhf.
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 19 Aug 2026 10:23:36 -0400
vim-common, vim-tiny (built from vim) updated from 2:9.1.2141-1ubuntu4.5 to 2:9.1.2141-1ubuntu4.9:
vim (2:9.1.2141-1ubuntu4.9) resolute-security; urgency=medium
* SECURITY UPDATE: Arbitrary command execution during C omni-completion.
- debian/patches/CVE-2026-73073.patch: Match tags typeref literally in
runtime/autoload/ccomplete.vim.
- CVE-2026-73073
-- Kyle Kernick <kyle.kernick@canonical.com> Mon, 24 Aug 2026 16:11:12 -0600
vim (2:9.1.2141-1ubuntu4.8) resolute-security; urgency=medium
* SECURITY UPDATE: Use-after-free on json decode error.
- debian/patches/CVE-2026-73071.patch: Report the position from the
current reader in src/json.c.
- CVE-2026-73071
* SECURITY UPDATE: Heap buffer overflow in set_sofo().
- debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in
src/spellfile.c.
- CVE-2026-73072
* SECURITY UPDATE: Heap overflow when adding > 65535 text properties.
- debian/patches/CVE-2026-73074.patch: Verify that the number of text
properties falls within the limit in src/errors.h and src/textprop.c.
- CVE-2026-73074
* SECURITY UPDATE: Code execution via VimballRecord file.
- debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix
broken directory deletion code, and refactor code in
runtime/autoload/vimball.vim
- CVE-2026-73076
* SECURITY UPDATE: Arbitrary code execution via keyword lookup.
- debian/patches/CVE-2026-73077.patch: For powershell, quote the commands
using single quotes, for sh/zsh pass the argument as a separate list
item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,
and ../zsh.vim.
- CVE-2026-73077
* SECURITY UPDATE: Code injection in netrw via bookmarks.
- debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in
runtime/pack/dist/opt/netrw/autoload/netrw.vim.
- CVE-2026-73078
* debian/patches/CVE-2026-28417.patch: Add test cases.
* debian/patches/CVE-2026-42307.patch: Refresh to align with CVE-2026-28417
-- Kyle Kernick <kyle.kernick@canonical.com> Tue, 18 Aug 2026 12:55:02 -0600
vim (2:9.1.2141-1ubuntu4.7) resolute-security; urgency=medium
* SECURITY UPDATE: Command execution in PHP omni-completion.
- debian/patches/CVE-2026-59856.patch: Quote the class name before
inserting it into the search() in runtime/autoload/phpcomplete.vim
- CVE-2026-59856
* SECURITY UPDATE: Stack out-of-bounds write in spell_soundfold_sal().
- debian/patches/CVE-2026-59857.patch: Bound the single-byte SAL result
writes in src/spell.c
- CVE-2026-59857
* SECURITY UPDATE: Arbitrary command execution during C omni-completion.
- debian/patches/CVE-2026-59858.patch: Escape the type field before
inserting it into pattern in runtime/autoload/ccomplete.vim
- CVE-2026-59858
-- Kyle Kernick <kyle.kernick@canonical.com> Mon, 13 Jul 2026 11:06:53 -0600
vim (2:9.1.2141-1ubuntu4.6) resolute-security; urgency=medium
* SECURITY UPDATE: Out-of-bounds write.
- debian/patches/CVE-2026-55693.patch: only descend while
depth < MAXWLEN - 1 in src/spellfile.c.
- debian/patches/CVE-2026-55892.patch: only descend while
depth < MAXWLEN - 1 in src/spell.c.
- CVE-2026-55693
- CVE-2026-55892
* SECURITY UPDATE: Code injection in local file deletion.
- debian/patches/CVE-2026-55895.patch: Use fnameescape() to escape
file name in runtime/pack/dist/opt/netrw/autoload/netrw.vim.
- CVE-2026-55895
* SECURITY UPDATE: Out-of-bounds read with sodium encrypted files.
- debian/patches/CVE-2026-57452.patch: Verify that there is enough space
before function call in src/crypt.c.
- CVE-2026-57452
* SECURITY UPDATE: Powershell code execution in zip.vim.
- debian/patches/CVE-2026-57453.patch: Escape powershell code in
runtime/autoload/zip.vim.
- CVE-2026-57453
* SECURITY UPDATE: Out-of-bounds write with soundfold().
- debian/patches/CVE-2026-57455.patch: Add an abort condition to validate
buffer in src/spell.c.
- CVE-2026-57455
* SECURITY UPDATE: Code execution with python complete.
- debian/patches/CVE-2026-57456.patch: Use repr() to quote the doc strings
in runtime/autoload/python3complete.vim and ../pythoncomplete.vim.
- CVE-2026-57456
-- Kyle Kernick <kyle.kernick@canonical.com> Tue, 30 Jun 2026 11:00:04 -0600
zlib1g (built from zlib) updated from 1:1.3.dfsg+really1.3.1-1ubuntu3 to 1:1.3.dfsg+really1.3.1-1ubuntu3.1:
zlib (1:1.3.dfsg+really1.3.1-1ubuntu3.1) resolute-security; urgency=medium
* SECURITY UPDATE: resource consumption via infinite loop
- debian/patches/CVE-2026-27171.patch: add negative length checks to
crc32_combine64 and crc32_combine_gen64 functions in crc32.c
- CVE-2026-27171
* Thanks to Mark Adler for the upstream fix.
-- Chrisa Oikonomou <chrisa.oikonomou@canonical.com> Tue, 25 Aug 2026 13:41:32 +0300