Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-106584 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a sligh | openssh openssh openssh openssh openssh openssh openssh openssh-gssapi openssh openssh-gssapi openssh openssh-gssapi openssh openssh openssh openssh openssh openssh openssh |
| CVE | CVE-2026-106583 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | openssh openssh openssh openssh openssh openssh openssh openssh-gssapi openssh openssh-gssapi openssh openssh-gssapi openssh openssh openssh openssh openssh openssh openssh |
| CVE | CVE-2026-106582 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing th | openssh openssh openssh openssh openssh openssh openssh openssh-gssapi openssh openssh-gssapi openssh openssh-gssapi openssh openssh openssh openssh openssh openssh openssh |
| CVE | CVE-2026-106555 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. | openssh openssh openssh openssh openssh openssh openssh openssh-gssapi openssh openssh-gssapi openssh openssh-gssapi openssh openssh openssh openssh openssh openssh openssh |
| CVE | CVE-2026-106553 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. | openssh openssh openssh openssh openssh openssh openssh openssh-gssapi openssh openssh-gssapi openssh openssh-gssapi openssh openssh openssh openssh openssh openssh openssh |
| CVE | CVE-2026-106552 | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive cop | openssh openssh openssh openssh openssh openssh openssh openssh-gssapi openssh openssh-gssapi openssh openssh-gssapi openssh openssh openssh openssh openssh openssh openssh |
| Launchpad | 2170806 | cdogs-sdl FTBFS on ppc64el: -Werror with -O3 false positives in bundled stb_image.h | cdogs-sdl cdogs-sdl |
| Launchpad | 2170538 | Ubuntu 24.04: systemd-resolved DNSSEC fails after root KSK rollover; built-in trust anchor lacks key 38696 | systemd systemd systemd systemd systemd systemd systemd systemd |
| Launchpad | 2170791 | luabind 1.1.1-1 FTBFS on amd64: tests segfault, object_rep misaligned in Lua userdata (exposed by LTO) | luabind luabind |
| Launchpad | 2170781 | ifhp FTBFS on amd64v3 (unquoted LDFLAGS) and with glibc 2.43 (C23 const string functions) | ifhp ifhp |
| Debian | 1149021 | octave-linear-algebra: Use d/checkvars instead of setting DH_OCTAVE_EXCLUDE_TEST in d/rules | octave-linear-algebra octave-linear-algebra |
| Debian | 1143310 | gammapy: FTBFS: E ImportError: cannot import name 'pixel_scale_angle_at_skycoord' from 'regions._utils.wcs_helpers' (/usr/lib/python3/dist-packages | gammapy gammapy |
| Launchpad | 2170776 | python3-sigima is empty: PYBUILD_DISABLE=python3.14 disables the only supported Python (breaks datalab) | python-sigima python-sigima |
| Launchpad | 2170782 | trurl 0.16.1-5 FTBFS: tests expect curl \u003e= 8.21 hex casing, stonking has curl 8.20 | trurl trurl |
| Launchpad | 2170723 | creation of __builtin_amdgcn_is_invocable macro breaks many rocm components | rocm-hipamd rocm-hipamd |
| CVE | CVE-2026-97689 | urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unb | python-urllib3 python-urllib3 python-urllib3 python-urllib3 python-urllib3 python-urllib3 |
| CVE | CVE-2026-97688 | urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop be | python-urllib3 python-urllib3 python-urllib3 python-urllib3 |
| CVE | CVE-2026-97687 | urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_co | python-urllib3 python-urllib3 |
| Debian | 1150712 | libglibutil FTCBFS: hard codes the build architecture strip | libglibutil libglibutil |
| CVE | CVE-2026-102273 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key | pyjwt pyjwt pyjwt pyjwt |
About
-
Send Feedback to @ubuntu_updates
