Threats Tagged 'ubuntu-26-04-lts'

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-<name>.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/<pid>/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.

Multiple vulnerabilities have been identified in .NET versions 8 and 10 as packaged for Ubuntu LTS releases. These issues include improper validation of authentication data, incorrect handling of XML encryption and cryptographic signatures, flawed input validation during TLS handshakes, and inadequate resource allocation controls. The vulnerabilities could allow attackers to elevate privileges, bypass authentication and authorization, cause denial of service through resource exhaustion or crashes, spoof SMTP messages, and inject malicious resources during container image builds. The affected versions are specific Ubuntu package builds of dotnet8 and dotnet10. No CVSS score is provided for these vulnerabilities.

A stack-buffer-overflow vulnerability exists in LuaJIT through version 2.1 and OpenRusty luajit2 before v2.1-20240626 in the lj_strfmt_wfnum function within lj_strfmt_num.c. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. Multiple specific package versions of LuaJIT are affected. No known exploits are reported in the wild at this time.

LuaJIT versions through 2.1 and OpenRusty luajit2 before v2.1-20240314 contain a vulnerability involving unsinking of IR_FSTORE for NULL metatable, which can lead to a Denial of Service (DoS) condition. This issue affects multiple specific versions of LuaJIT as packaged in various Ubuntu releases. The vulnerability does not impact confidentiality or integrity but can cause application or system availability disruption.

LuaJIT through version 2.1 and OpenRusty luajit2 before v2.1-20240314 contain an out-of-bounds read vulnerability in the stack-overflow handler located in lj_state.c. This vulnerability can lead to a high impact on confidentiality and availability without requiring user interaction or privileges. Multiple specific versions of LuaJIT are affected, including several Ubuntu package versions. No known exploits are reported in the wild at this time.

An improper handling of case sensitivity vulnerability exists in Apache Tomcat's CGI servlet, allowing bypass of security constraints applied to the pathInfo component of a URI. This affects multiple Apache Tomcat versions including 11.0.0-M1 through 11.0.6, 10.1.0-M1 through 10.1.40, 9.0.0-M1 through 9.0.104, and some older EOL versions such as 8.5.0 through 8.5.100. The issue is fixed in versions 11.0.7, 10.1.41, and 9.0.105. Users should upgrade to these fixed versions to address the vulnerability.

A resource allocation vulnerability exists in Apache Tomcat versions from 11.0.0-M1 through 11.0.7, 10.1.0-M1 through 10.1.41, and 9.0.0.M1 through 9.0.105, including some older EOL versions such as 8.5.0 through 8.5.100. This flaw allows allocation of resources without limits or throttling, potentially leading to denial of service. Fixed versions are 11.0.8, 10.1.42, and 9.0.106. The vulnerability affects multiple Ubuntu package versions as listed. No known exploits in the wild have been reported.

An Improper Resource Shutdown or Release vulnerability exists in Apache Tomcat, affecting versions from 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0-M1 through 9.0.107. This vulnerability is known as the 'made you reset' attack. Users are advised to upgrade to versions 11.0.10, 10.1.44, or 9.0.108 where the issue is fixed.