Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-44169 | MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user get | mariadb mariadb mariadb mariadb |
| CVE | CVE-2026-44168 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11 | mariadb mariadb mariadb mariadb |
| Debian | 557676 | Typo in package description: "This packages" | plib-doc |
| Debian | 778971 | plib-doc: please make the build reproducible | plib-doc |
| Launchpad | 2157593 | Update firmware for linux-hwe-7.0 | linux-firmware |
| Launchpad | 2158073 | HP ISH firmware missing for Intel Lunar Lake and Panther Lake systems | linux-firmware-intel-misc linux-firmware |
| Launchpad | 2158809 | [SRU][S/R/N] mt7925: add support for the India, Tunisia and Paraguay country codes | linux-firmware-mediatek linux-firmware |
| Launchpad | 2158956 | [SRU] Add firmware for Cirrus Amps for some Lenovo laptops (17aa235c 17aa235d) | linux-firmware-misc linux-firmware |
| CVE | CVE-2026-6045 | LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The n | libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice |
| CVE | CVE-2026-6040 | A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not chec | libreoffice libreoffice libreoffice libreoffice |
| CVE | CVE-2026-6039 | LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count | libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice |
| CVE | CVE-2026-8358 | LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identi | libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice |
| CVE | CVE-2026-8357 | LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many | libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice |
| CVE | CVE-2026-8356 | LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two | libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice libreoffice |
| CVE | CVE-2026-14330 | Multiple unbounded alloca() calls in the PulseAudio protocol server. | pipewire pipewire pipewire pipewire pipewire pipewire pipewire pipewire pipewire pipewire pipewire pipewire |
| CVE | CVE-2026-14324 | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. | pipewire pipewire pipewire pipewire pipewire pipewire pipewire pipewire |
| CVE | CVE-2026-40386 | In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak | libexif libexif libexif libexif libexif libexif |
| CVE | CVE-2026-40385 | In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or inform | libexif libexif libexif libexif libexif libexif |
| CVE | CVE-2026-32775 | libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer wou | libexif libexif libexif libexif libexif libexif |
| CVE | CVE-2026-58050 | libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attr | libssh2 libssh2 libssh2 libssh2 |
About
-
Send Feedback to @ubuntu_updates
