Tuxcare Errata System 0.0.1 5.10 2026-09-18T13:22:50 Ubuntu 22.04 LTS * fix changelog Important TuxCare License Agreement CVE-2026-22796 CVE-2025-69421 Ubuntu 22.04 LTS * SECURITY UPDATE: excessive time spent in DH check/generation with large Q - debian/patches/openssl-1.1.1-cve-2023-5678.patch: add bounds checks for excessively large Q parameter in DH_check_pub_key() and DH_generate_key() - CVE-2023-5678 * SECURITY UPDATE: PKCS12 decoding crashes due to NULL pointer dereference - debian/patches/openssl-1.1.1-cve-2024-0727.patch: add NULL checks where ContentInfo data can be NULL in PKCS12/PKCS7 parsing functions - CVE-2024-0727 Moderate TuxCare License Agreement CVE-2024-0727 CVE-2023-5678 Ubuntu 22.04 LTS * SECURITY UPDATE: use-after-free in DANE client code - debian/patches/openssl-1.1.1-cve-2026-28387.patch: use X509_free() instead of OPENSSL_free() to properly release reference-counted X509 objects in dane_match() - CVE-2026-28387 * SECURITY UPDATE: NULL pointer dereference in delta CRL processing - debian/patches/openssl-1.1.1-cve-2026-28388.patch: add NULL check for delta->crl_number before dereferencing in check_delta_base() - CVE-2026-28388 * SECURITY UPDATE: NULL pointer dereference in CMS KeyAgreeRecipientInfo - debian/patches/openssl-1.1.1-cve-2026-28389.patch: use safe X509_ALGOR_get0() extraction in dh_cms_set_shared_info() and ecdh_cms_set_shared_info() - CVE-2026-28389 * SECURITY UPDATE: NULL pointer dereference in CMS KeyTransportRecipientInfo - debian/patches/openssl-1.1.1-cve-2026-28390.patch: use safe X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data in rsa_cms_decrypt() - CVE-2026-28390 Important TuxCare License Agreement CVE-2026-28389 CVE-2026-28390 CVE-2026-28388 CVE-2026-28387 Ubuntu 22.04 LTS * SECURITY UPDATE: use-after-free in PKCS7_verify - debian/patches/openssl-1.1.1-cve-2026-45447.patch: free the BIO chain explicitly and stop at the caller-supplied indata BIO so a crafted PKCS#7 / S-MIME message with an empty digestAlgorithms ASN.1 SET can no longer make OpenSSL free a caller-owned BIO in PKCS7_verify() - CVE-2026-45447 Critical TuxCare License Agreement CVE-2026-45447 Ubuntu 22.04 LTS * SECURITY UPDATE: HollowByte handshake-buffer pre-allocation DoS - debian/patches/openssl-1.1.1-hollowbyte.patch: grow the handshake init_buf incrementally as data is received instead of pre-allocating the full peer-declared message size, so a peer that claims a large message but never sends it can no longer strand memory. Backport of OpenSSL 3.0 commit c5785a5e35 (PR #30794). OpenSSL handled this as a "bug or hardening" fix, so no CVE was assigned. - ELS-2635 Important TuxCare License Agreement CVE-2025-69419 Ubuntu 22.04 LTS * SECURITY UPDATE: heap buffer over-read parsing large DER ASN.1 elements - debian/patches/openssl-1.1.1-cve-2026-34180.patch: keep the ASN.1 content length as a long in asn1_ex_c2i() and reject elements whose length does not fit in an int, so a primitive element longer than 2GB can no longer be truncated into a negative length and make ASN1_STRING_set() read past the end of the input buffer. - CVE-2026-34180 * SECURITY UPDATE: NULL pointer dereference in password-based CMS decryption - debian/patches/openssl-1.1.1-cve-2026-42766.patch: check that the OPTIONAL PasswordRecipientInfo.keyDerivationAlgorithm field is present before dereferencing it in cms_RecipientInfo_pwri_crypt(), so a crafted password-encrypted CMS message can no longer crash the application. - CVE-2026-42766 Important TuxCare License Agreement CVE-2026-34180 CVE-2026-42766 Ubuntu 22.04 LTS * SECURITY UPDATE: out-of-bounds read in the libxml2 regexp parser - debian/patches/libxml2-2.10.2-CVE-2026-86137.patch: bounds-check the parser cursor in xmlFAParsePosCharGroup before the NXT macro reads past the end of the expression; backport of upstream libxml2 76fe08d9 (v2.15.4) - CVE-2026-86137 * SECURITY UPDATE: integer overflow and heap buffer overflow in xmlDictAddQString - debian/patches/libxml2-2.10.2-CVE-2026-86138.patch: add overflow checks to the pool size arithmetic in dict.c before allocating and copying the qualified name; backport of upstream libxml2 a4cba4b5 (v2.15.4) - CVE-2026-86138 * SECURITY UPDATE: stack buffer overflow in xmlSnprintfElements - debian/patches/libxml2-2.10.2-CVE-2025-24928.patch: compute the combined QName length once, before any append, so the bounds check in the xmlSnprintfElements loop is no longer made against a stale buffer length; backport of upstream libxml2 8c8753ad (v2.14.0). This is the overflow that is reachable on 2.10.2: a DTD content model whose element QNames exceed the 5000-byte dump buffer (xmllint --valid) overflows the stack - CVE-2025-24928 * SECURITY UPDATE: unchecked strcat around the xmlSnprintfElements loop - debian/patches/libxml2-2.10.2-CVE-2026-86140.patch: replace the unchecked strcat calls at the entry and exit of the DTD content-model dump in valid.c with bounds-checked appends; backport of upstream libxml2 d1686f91 (v2.15.4). On 2.10.2 both sites are hardening only: the function is static and its callers pass a freshly emptied buffer, so the overflow that can be reached is the one fixed by the CVE-2025-24928 patch above - CVE-2026-86140 * SECURITY UPDATE: NULL pointer dereference in xmlRegNewParserCtxt - debian/patches/libxml2-2.10.2-CVE-2026-86141.patch: compute the expression length only after the xmlStrdup result has been NULL- checked in xmlregexp.c; backport of upstream libxml2 e89a8aae (v2.15.4) - CVE-2026-86141 * SECURITY UPDATE: heap buffer overflow in xmlXPtrEvalXPtrPart - debian/patches/libxml2-2.10.2-CVE-2026-86142.patch: check the xpointer part length for overflow before allocating the evaluation buffer in xpointer.c; backport of upstream libxml2 6b3a736c (v2.15.4) - CVE-2026-86142 * SECURITY UPDATE: negative lengths reaching output write callbacks - debian/patches/libxml2-2.10.2-CVE-2026-86143.patch: check for int overflow between xmlBufUse and the write callback length in xmlIO.c so a negative length can no longer reach xmlOutputWriteCallback; backport of upstream libxml2 90f293ba (v2.15.4) - CVE-2026-86143 * SECURITY UPDATE: XInclude ignores the document parse flags - debian/patches/libxml2-2.10.2-CVE-2026-86144.patch: make xmlXIncludeProcess and xmlXIncludeProcessTree propagate the document's parseFlags (e.g. XML_PARSE_NONET) to the include context in xinclude.c; backport of upstream libxml2 b63cd517 (v2.15.4) - Behaviour change: the include context now inherits every parse flag of the document, XML_PARSE_NOENT, XML_PARSE_RECOVER and XML_PARSE_HUGE included, not only XML_PARSE_NONET. A document parsed with XML_PARSE_NOENT and then passed to xmlXIncludeProcess() now also substitutes external entities inside the included documents; callers that must not load them should not pass XML_PARSE_NOENT, or should call xmlXIncludeProcessFlags() with an explicit flag set. PHP's DOMDocument::xinclude() already uses xmlXIncludeProcessFlags() and is unaffected - CVE-2026-86144 * Fix deb packaging defects surfaced by the first Debian/Ubuntu build: point the alt-libxml2-devel libxml2.so symlink at the 2.10.2 soname (was 2.9.7) and repair the malformed 2.9.7-2 changelog trailer (three spaces before the date). Critical TuxCare License Agreement CVE-2026-86140 CVE-2026-86138 CVE-2026-86137 CVE-2025-24928 CVE-2026-86144 CVE-2026-86142 CVE-2026-86141 CVE-2026-86143 Ubuntu 22.04 LTS * SECURITY UPDATE: use-after-free after xmlSchemaItemListAdd - debian/patches/libxml2-2.10.2-CVE-2024-56171.patch: refresh the cached pointer to the duplicates array after xmlSchemaItemListAdd() may have reallocated it, in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c; backport of upstream libxml2 5880a9a6 (v2.12.10, v2.13.6, v2.14.0). Reachable from schema validation of an untrusted instance document that produces duplicate identity-constraint keys. The second site additionally checks xmlSchemaItemListAdd()'s return before refreshing the pointer: 2.10.2 assigns xmlRealloc()'s result straight to list->items, so unlike upstream it leaves it NULL on failure - CVE-2024-56171 * SECURITY UPDATE: use-after-free in xmlParseInternalSubset - debian/patches/libxml2-2.10.2-CVE-2026-6653.patch: drop the post-push XML_PARSER_EOF check from xmlPushInput(), and give the xmlSkipBlankChars() loop an XML_PARSER_EOF guard, both in parser.c; backports of upstream libxml2 f19a9510 (its xmlPushInput hunk) and e129c1d1. xmlPushInput() tested for a halted parser only after inputPush() had already installed the input as ctxt->input, and then returned -1, so xmlParsePEReference() freed an input stream that ctxt->input still pointed at and a crafted DTD internal subset caused a heap use-after-free read in xmlParseInternalSubset(). With that input no longer freed the parser goes on to re-enter xmlSkipBlankChars(), whose loop was unconditional while NEXT is a no-op on a halted parser, so the same document would spin at 100% CPU instead of crashing; the guard ends the loop, matching the three other loops in the file. The halt comes from the entity amplification check added for CVE-2021-3541, which 2.10.2 carries; that check is left in place. The upstream fix for this CVE (463bbeec, v2.11.0) is not used: it appends members to the public xmlEntity and xmlParserInput structs, changing their size, and enforces the amplification cap even under XML_PARSE_HUGE - CVE-2026-6653 Critical TuxCare License Agreement CVE-2024-56171 CVE-2026-6653 Ubuntu 22.04 LTS * SECURITY UPDATE: excessive memory use buffering DTLS records - debian/patches/openssl-1.1.1-cve-2026-54874.patch: copy only the record's own on-wire bytes into the queue entry in dtls1_buffer_record(), and copy them back into the live read buffer in dtls1_copy_record(), instead of handing the whole ~16.7KB read buffer to the queue and allocating a fresh one, so a peer sending a stream of tiny next-epoch records can no longer pin ~1.7MB of heap per connection; also lower the cap on the next-epoch (unprocessed_rcds) queue from 100 records to 16, which the same patch passes to dtls1_buffer_record() as an argument so that the other two queues keep the 100-record limit. - CVE-2026-54874 Important TuxCare License Agreement CVE-2026-54874 Ubuntu 22.04 LTS * SECURITY UPDATE: NULL pointer dereference in xmlPatMatch - debian/patches/libxml2-2.10.2-CVE-2025-27113.patch: compile an explicit child:: axis step to XML_OP_ELEM instead of XML_OP_CHILD in xmlCompileStepPattern() in pattern.c; backport of upstream libxml2 503f788e (v2.12.10, v2.13.6, v2.14.0). XML_OP_CHILD accepts a document node and does not advance the current node, so a pattern such as "/child::name" matched against a document node reached the unguarded node->parent load in the XML_OP_ROOT case of xmlPatMatch() and crashed. Reachable through the public xmlPatternMatch(), used in-tree by xmlTextReaderPreservePattern() and by Schematron rule contexts; the streaming matcher already compiled the child axis correctly, so XML Schema identity constraints and the XPath streaming optimisation are unaffected. Upstream fixed only the compiler side and leaves the XML_OP_ROOT load unguarded to this day; it is left unguarded here too, and no in-tree caller reaches it. Behaviour change: patterns using the explicit child:: axis now select the named element itself rather than its parent, which is correct XPath and what the streaming matcher already did - CVE-2025-27113 * SECURITY UPDATE: heap out-of-bounds read in xmlSchemaIDCFillNodeTables - debian/patches/libxml2-2.10.2-CVE-2025-32415.patch: use the live bind->nbNodes instead of the stale local nbNodeTable for both the guard and the terminator of the IDC node-table loop in xmlSchemaIDCFillNodeTables in xmlschemas.c; backport of upstream libxml2 384cc7c1 (v2.13.8), whose master twin is 487ee1d8 (v2.14.2). nbNodeTable is snapshotted before the target loop, but the loop shrinks the node table every time it moves a duplicate key-sequence to bind->dupls, so from the next target onwards the loop walks slots past the live end of the table; once the table is empty the guard is still true and a match evaluates bind->nodeTable[-1], reading one element before the start of the heap allocation and leaving bind->nbNodes negative for the targets that follow. Reachable from schema validation of an untrusted instance document against a schema carrying identity constraints, or from an untrusted schema. Applied on top of libxml2-2.10.2-CVE-2024-56171.patch, which edits the same function but a different defect (a stale pointer rather than a stale count) and does not overlap these hunks - CVE-2025-32415 * SECURITY UPDATE: integer overflow in xmlBuildQName leading to a stack-based buffer overflow - debian/patches/libxml2-2.10.2-CVE-2025-6021.patch: hold the local-name and prefix lengths in size_t, reject a negative len, and bound lenn + lenp + 2 against SIZE_MAX before the buffer-size test and the allocation, in tree.c; backport of upstream libxml2 17d950ae (v2.13.9). The lengths were held in int and summed in int arithmetic, so a long enough QName made lenn + lenp + 2 wrap negative, which both defeated the buffer-size test - handing back a caller's 50-byte stack buffer - and undersized the xmlMallocAtomic() allocation, letting the following memcpy()s and the NUL store write out of bounds - CVE-2025-6021 * SECURITY UPDATE: stack-based buffer overflows in xmlcatalog --shell - debian/patches/libxml2-2.10.2-CVE-2026-11979.patch: bounds-check the three copy loops in usershell() in xmlcatalog.c, which wrote a line of user input into the fixed command[100], arg[400] and argv[20] stack buffers with no limit at all; backport of upstream libxml2 cd48d441 (v2.15.4), whose xmlcatalog.c hunks are identical to master's c2e233fc. Over-long input is now rejected with a diagnostic instead of corrupting the stack frame. Upstream's test/catalogs/test.sh hunk is dropped because that file does not exist in 2.10.2; usershell() itself is byte-identical to upstream's pre-fix version, so the guards are carried verbatim. Affects only the xmlcatalog command-line utility shipped by this package -- no library entry point reaches usershell() - CVE-2026-11979 * Harden the xmlcatalog command line parser - debian/patches/libxml2-2.10.2-xmlcatalog-argv-oob-read.patch: check that --add and --del were given enough arguments before indexing argv in main() in xmlcatalog.c; backport of upstream libxml2 b1fea45b. This is not a CVE and is not part of CVE-2026-11979; it is carried alongside it because upstream shipped both in the same release and both touch the same file. "xmlcatalog --add a" read argv[4] past the end of the argument vector and passed whatever followed it, in practice a process environment string, to xmlCatalogAdd() Important TuxCare License Agreement CVE-2026-11979 CVE-2025-32415 CVE-2022-49043 CVE-2025-6021 CVE-2022-40303 CVE-2022-40304 CVE-2024-25062 CVE-2025-27113 Ubuntu 22.04 LTS * EA4D-994: Update to 10.48 version * Bundled Unicode data updated 16.0 -> 17.0, changing what existing patterns match with no soname change: \d gains U+11DE0-U+11DE9, \w and \p{L} gain characters too, and U+0320 no longer matches \p{Latin}. Anything linked against libpcre2-8.so.0 sees this on upgrade without a rebuild; alt-php uses PHP's bundled PCRE2 and is not affected. Critical TuxCare License Agreement CVE-2026-89158 CVE-2026-89157 alt-openssl alt-openssl-dev alt-openssl-doc alt-openssl-libs alt-openssl11 alt-openssl11-dev alt-openssl11-doc alt-openssl11-libs alt-libxml2 alt-libxml2-devel alt-libxml2-doc alt-libxml2-static alt-pcre2 alt-pcre2-dev alt-pcre2-static alt-pcre2-tools alt-pcre2-utf16 alt-pcre2-utf32 amd64 0:1.1.1w-3.1 0:1.1.1w-3.1 amd64 0:1.1.1w-3.2 0:1.1.1w-3.2 amd64 0:1.1.1w-3.4 0:1.1.1w-3.4 amd64 0:1.1.1w-3.5 0:1.1.1w-3.5 amd64 0:1.1.1w-3.7 0:1.1.1w-3.7 amd64 0:1.1.1w-3.8 0:1.1.1w-3.8 amd64 0:2.10.2-4 0:2.10.2-4 amd64 0:2.10.2-5 0:2.10.2-5 amd64 0:1.1.1w-3.10 0:1.1.1w-3.10 amd64 0:2.10.2-7 0:2.10.2-7 amd64 0:10.48-1