Vulnerabilities & updates
Fri, October 23
USN-8954-1: zlib vulnerability
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution.
USN-8953-1: OpenVPN vulnerability
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Thu, October 22
USN-8952-1: Tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
USN-8890-2: libsoup vulnerabilities
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 2…
USN-8951-1: c-ares vulnerabilities
It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-4904) It was discovered that c-ares did not properly limit DNS compression p…
USN-8947-1: NSS update
This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.
USN-8950-1: poppler vulnerability
It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.
USN-8930-2: U-Boot vulnerabilities
USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker…
USN-8949-1: Ghostscript vulnerabilities
Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (CVE-2026-101258) It was discovered that Ghostscript incorrectly handled memory when converting certain fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause Ghostscript to crash, or possibly ex…
USN-8948-2: PHP vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-20…
Tue, July 14
runc v1.5.1 -- "El lujo es vulgaridad, dijo, y me conquistó."
This is the first patch release in the 1.5.z release series of runc, and primarily includes a fix for a serious regression on Ubuntu 20.04 kernels. Fixed There was a regression reported in with the maskPaths optimisation added in 1.5.0-rc.3 ( #5275 ). On Ubuntu Focal (20.04), attempts to mount tmpfs with the nr_inodes=1 option will fail due to a downstream kernel patch (ironically originating from AUFS). We now have a fallback path using nr_inodes=2 instead if the operation fails. ( #5348 , #5358 , #5359 ) Properly handle EINVAL for seccomp SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV when trying t…
Tue, May 10
Forge: Ubuntu 22.04 Support
We're excited to announce that Laravel Forge now supports Ubuntu 22.04 (Jammy) - the latest Ubuntu LTS release from Canonical!
Wed, October 21
Forge: Enabling TLS 1.3
As of today, newly issued LetsEncrypt certificates on Laravel Forge servers that run on Ubuntu 20.04 have TLS 1.3 enabled by default. TLS 1.3 offers a faster handshake and more secure cipher suites....
Thu, May 21
Forge: Ubuntu 20.04 & New AWS Regions
Beginning today, Forge will provision all new servers with Ubuntu 20.04, the latest Ubuntu LTS release. If you would like to provision a new server using Forge's "Custom VPS" option, you should now en...