https://ubuntu.com/security/notices/rss.xmlRecent content on Ubuntu security notices2026 Canonical Ltd. Ubuntu and Canonical are registered trademarks of Canonical Ltd.http://www.rssboard.org/rss-specificationFeedgenThu, 05 Nov 2026 04:57:48 +0000https://ubuntu.com/security/notices/USN-9000-1It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources, leading to a denial of service.https://ubuntu.com/security/notices/USN-9000-1Wed, 04 Nov 2026 16:24:47 +0000https://ubuntu.com/security/notices/USN-8999-1It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-54058) It was discovered that Pillow did not properly check for decompression bombs when processing font files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379) It was discovered that Pillow did not properly check for decompression bombs when loading GD image files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-55380) It was discovered that Pillow incorrectly validated filter sizes in the rank filter implementation. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59197) It was discovered that Pillow incorrectly handled image coordinate calculations. An attacker could possibly use this issue to cause Pillow to crash. (CVE-2026-59199) It was discovered that Pillow did not properly limit the size of decompressed PDF stream data. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59200) It was discovered that Pillow incorrectly parsed EPS files containing a negative byte count in the BeginBinary directive. An attacker could possibly use this issue to cause Pillow to hang, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59203) It was discovered that Pillow incorrectly accumulated JPEG2000 tile component widths. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59204) It was discovered that Pillow incorrectly validated image mode compatibility in color management transforms. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59205)https://ubuntu.com/security/notices/USN-8999-1Wed, 04 Nov 2026 15:49:54 +0000https://ubuntu.com/security/notices/USN-8998-1It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches.https://ubuntu.com/security/notices/USN-8998-1Wed, 04 Nov 2026 15:32:22 +0000https://ubuntu.com/security/notices/USN-8997-1It was discovered that Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker could possibly use this issue to cause Net-SNMP to block indefinitely, resulting in a denial of service.https://ubuntu.com/security/notices/USN-8997-1Wed, 04 Nov 2026 15:25:21 +0000https://ubuntu.com/security/notices/USN-7530-2USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Original advisory details: It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.https://ubuntu.com/security/notices/USN-7530-2Wed, 04 Nov 2026 15:14:52 +0000https://ubuntu.com/security/notices/USN-8996-1Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.https://ubuntu.com/security/notices/USN-8996-1Wed, 04 Nov 2026 13:37:00 +0000https://ubuntu.com/security/notices/USN-8994-1It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-59933) It was discovered that libvips incorrectly determined image dimensions in the vipsload operation, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-33327) It was discovered that libvips incorrectly determined image dimensions in the gifload operation on 32-bit systems, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-33328) It was discovered that libvips did not properly validate EXIF tag groups. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-35590) It was discovered that libvips incorrectly determined the number of channels in certain encoded tiles within TIFF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591) It was discovered that libvips incorrectly validated scanlines in certain TIFF images with many bands, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, obtain sensitive information, or possibly execute arbitrary code. (CVE-2026-69242) It was discovered that libvips incorrectly calculated frame heights when loading certain multi-page TIFF images through ImageMagick. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-70651) It was discovered that libvips incorrectly handled certain Radiance images. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-70653) It was discovered that libvips incorrectly calculated read sizes when processing certain uncompressed PPM images from custom sources. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70654)https://ubuntu.com/security/notices/USN-8994-1Tue, 03 Nov 2026 17:39:43 +0000https://ubuntu.com/security/notices/USN-8993-1It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.https://ubuntu.com/security/notices/USN-8993-1Tue, 03 Nov 2026 17:38:49 +0000https://ubuntu.com/security/notices/USN-8992-1It was discovered that the shpsort utility in Shapelib incorrectly handled certain inputs, leading to a double free. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.https://ubuntu.com/security/notices/USN-8992-1Tue, 03 Nov 2026 17:38:38 +0000https://ubuntu.com/security/notices/USN-8991-1It was discovered that rxvt-unicode incorrectly handled certain escape sequences. An attacker could possibly use this issue to execute arbitrary code if a user displayed specially crafted text in the terminal.https://ubuntu.com/security/notices/USN-8991-1Tue, 03 Nov 2026 17:37:49 +0000