28/01/2026, commit https://github.com/canonical/core-base/tree/35ba5381ea78d6904d4e5d475e1aee78f7b61172

[ Changes in the core22 snap ]

No detected changes for the core22 snap

[ Changes in primed packages ]

libglib2.0-0:amd64 (built from glib2.0) updated from 2.72.4-0ubuntu2.7 to 2.72.4-0ubuntu2.8:

  glib2.0 (2.72.4-0ubuntu2.8) jammy-security; urgency=medium

    * SECURITY UPDATE: Integer overflow in g_buffered_input_stream_peek()
      - debian/patches/CVE-2026-0988.patch: fix a potential integer overflow
        in peek() in gio/gbufferedinputstream.c,
        gio/tests/buffered-input-stream.c.
      - CVE-2026-0988

   -- Marc Deslauriers <[email protected]>  Tue, 20 Jan 2026 08:55:03 -0500

libc-bin, libc6:amd64, libc6:i386 (built from glibc) updated from 2.35-0ubuntu3.11 to 2.35-0ubuntu3.12:

  glibc (2.35-0ubuntu3.12) jammy; urgency=medium

    * d/p/lp2089789-*.patch: fix malloc performance regression (LP: #2089789)

   -- Simon Chopin <[email protected]>  Tue, 15 Jul 2025 11:40:00 +0200

libpng16-16:amd64 (built from libpng1.6) updated from 1.6.37-3ubuntu0.1 to 1.6.37-3ubuntu0.3:

  libpng1.6 (1.6.37-3ubuntu0.3) jammy-security; urgency=medium

    * SECURITY UPDATE: OOB in png_image_read_composite
      - debian/patches/CVE-2025-66293-1.patch: validate component size in
        pngread.c.
      - debian/patches/CVE-2025-66293-2.patch: improve fix in pngread.c.
      - CVE-2025-66293
    * SECURITY UPDATE: Heap buffer over-read in png_image_read_direct_scaled
      - debian/patches/CVE-2026-22695.patch: fix memcpy size in pngread.c.
      - CVE-2026-22695
    * SECURITY UPDATE: Integer truncation causing heap buffer over-read
      - debian/patches/CVE-2026-22801.patch: remove incorrect truncation
        casts in CMakeLists.txt, contrib/libtests/pngstest.c, pngwrite.c,
        tests/pngstest-large-stride.
      - CVE-2026-22801

   -- Marc Deslauriers <[email protected]>  Mon, 12 Jan 2026 13:14:59 -0500

libssl3:amd64, openssl (built from openssl) updated from 3.0.2-0ubuntu1.20 to 3.0.2-0ubuntu1.21:

  openssl (3.0.2-0ubuntu1.21) jammy-security; urgency=medium

    * SECURITY UPDATE: Stack buffer overflow in CMS AuthEnvelopedData parsing
      - debian/patches/CVE-2025-15467-1.patch: correct handling of
        AEAD-encrypted CMS with inadmissibly long IV in crypto/evp/evp_lib.c.
      - debian/patches/CVE-2025-15467-2.patch: some comments to clarify
        functions usage in crypto/asn1/evp_asn1.c.
      - debian/patches/CVE-2025-15467-3.patch: test for handling of
        AEAD-encrypted CMS with inadmissibly long IV in test/cmsapitest.c,
        test/recipes/80-test_cmsapi.t,
        test/recipes/80-test_cmsapi_data/encDataWithTooLongIV.pem.
      - CVE-2025-15467
    * SECURITY UPDATE: Heap out-of-bounds write in BIO_f_linebuffer on short
      writes
      - debian/patches/CVE-2025-68160.patch: fix heap buffer overflow in
        BIO_f_linebuffer in crypto/bio/bf_lbuf.c.
      - CVE-2025-68160
    * SECURITY UPDATE: Unauthenticated/unencrypted trailing bytes with
      low-level OCB function calls
      - debian/patches/CVE-2025-69418.patch: fix OCB AES-NI/HW stream path
        unauthenticated/unencrypted trailing bytes in crypto/modes/ocb128.c.
      - CVE-2025-69418
    * SECURITY UPDATE: Out of bounds write in PKCS12_get_friendlyname() UTF-8
      conversion
      - debian/patches/CVE-2025-69419.patch: check return code of UTF8_putc
        in crypto/asn1/a_strex.c, crypto/pkcs12/p12_utl.c.
      - CVE-2025-69419
    * SECURITY UPDATE: Missing ASN1_TYPE validation in
      TS_RESP_verify_response() function
      - debian/patches/CVE-2025-69420.patch: verify ASN1 object's types
        before attempting to access them as a particular type in
        crypto/ts/ts_rsp_verify.c.
      - CVE-2025-69420
    * SECURITY UPDATE: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex
      - debian/patches/CVE-2025-69421.patch: add NULL check in
        crypto/pkcs12/p12_decr.c.
      - CVE-2025-69421
    * SECURITY UPDATE: ASN1_TYPE missing validation and type confusion
      - debian/patches/CVE-2026-2279x.patch: ensure ASN1 types are checked
        before use in apps/s_client.c, crypto/pkcs12/p12_kiss.c,
        crypto/pkcs7/pk7_doit.c.
      - CVE-2026-22795
      - CVE-2026-22796

   -- Marc Deslauriers <[email protected]>  Mon, 26 Jan 2026 07:32:08 -0500

python3-urllib3 (built from python-urllib3) updated from 1.26.5-1~exp1ubuntu0.5 to 1.26.5-1~exp1ubuntu0.6:

  python-urllib3 (1.26.5-1~exp1ubuntu0.6) jammy-security; urgency=medium

    * SECURITY REGRESSION: Missing _has_decoded_content from CVE-2026-21441
      (LP: #2138420)
      - debian/patches/CVE-2026-21441-fix1.patch: Implement _has_decoded_content
        and decoded checks in src/urllib3/response.py. Add tests in
        test/test_response.py.

   -- Hlib Korzhynskyy <[email protected]>  Fri, 16 Jan 2026 19:39:26 -0330

13/01/2026, commit https://github.com/canonical/core-base/tree/35ba5381ea78d6904d4e5d475e1aee78f7b61172

[ Changes in the core22 snap ]

Philip Meulengracht (1):
      static: add snapd.conf to tmpfiles.d (#383)

[ Changes in primed packages ]

apparmor, libapparmor1:amd64 (built from apparmor) updated from 3.0.4-2ubuntu2.4 to 3.0.4-2ubuntu2.5:

  apparmor (3.0.4-2ubuntu2.5) jammy; urgency=medium

    * profiles: make /sys/devices PCI paths hex-aware (LP: #2115234)

   -- Keifer Snedeker <[email protected]>  Fri, 15 Aug 2025 13:17:13 +0100

libglib2.0-0:amd64 (built from glib2.0) updated from 2.72.4-0ubuntu2.6 to 2.72.4-0ubuntu2.7:

  glib2.0 (2.72.4-0ubuntu2.7) jammy-security; urgency=medium

    * SECURITY UPDATE: overflow via long invalid ISO 8601 timestamp
      - debian/patches/CVE-2025-3360-1.patch: fix integer overflow when
        parsing very long ISO8601 inputs in glib/gdatetime.c.
      - debian/patches/CVE-2025-3360-2.patch: fix potential integer overflow
        in timezone offset handling in glib/gdatetime.c.
      - debian/patches/CVE-2025-3360-3.patch: track timezone length as an
        unsigned size_t in glib/gdatetime.c.
      - debian/patches/CVE-2025-3360-4.patch: factor out some string pointer
        arithmetic in glib/gdatetime.c.
      - debian/patches/CVE-2025-3360-5.patch: factor out an undersized
        variable in glib/gdatetime.c.
      - debian/patches/CVE-2025-3360-6.patch: add some missing GDateTime
        ISO8601 parsing tests in glib/tests/gdatetime.c.
      - CVE-2025-3360
    * SECURITY UPDATE: GString overflow
      - debian/patches/CVE-2025-6052.patch: fix overflow check when expanding
        the string in glib/gstring.c.
      - CVE-2025-6052
    * SECURITY UPDATE: integer overflow in temp file creation
      - debian/patches/CVE-2025-7039.patch: fix computation of temporary file
        name in glib/gfileutils.c.
      - CVE-2025-7039
    * SECURITY UPDATE: heap overflow in g_escape_uri_string()
      - debian/patches/CVE-2025-13601.patch: add overflow check in
        glib/gconvert.c.
      - CVE-2025-13601
    * SECURITY UPDATE: buffer underflow through glib/gvariant
      - debian/patches/CVE-2025-14087-1.patch: fix potential integer overflow
        parsing (byte)strings in glib/gvariant-parser.c.
      - debian/patches/CVE-2025-14087-2.patch: use size_t to count numbers of
        child elements in glib/gvariant-parser.c.
      - debian/patches/CVE-2025-14087-3.patch: convert error handling code to
        use size_t in glib/gvariant-parser.c.
      - CVE-2025-14087
    * SECURITY UPDATE: integer overflow in gfileattribute
      - debian/patches/gfileattribute-overflow.patch: add overflow check in
        gio/gfileattribute.c.
      - No CVE number

   -- Marc Deslauriers <[email protected]>  Wed, 10 Dec 2025 11:09:12 -0500

gpgv (built from gnupg2) updated from 2.2.27-3ubuntu2.4 to 2.2.27-3ubuntu2.5:

  gnupg2 (2.2.27-3ubuntu2.5) jammy-security; urgency=medium

    * SECURITY UPDATE: Remote Code Execution
      - debian/patches/CVE-2025-68973.patch: gpg: Fix possible memory
      corruption in the armor parser.
      - CVE-2025-68973

   -- Allen Huang <[email protected]>  Mon, 05 Jan 2026 22:14:39 +0000

libpng16-16:amd64 (built from libpng1.6) updated from 1.6.37-3build5 to 1.6.37-3ubuntu0.1:

  libpng1.6 (1.6.37-3ubuntu0.1) jammy-security; urgency=medium

    * SECURITY UPDATE: buffer overflow issue
      - debian/patches/CVE-2025-64505.patch: Fix a buffer overflow in
        png_do_quantize
      - debian/patches/CVE-2025-64506.patch: Fix a heap buffer overflow in
        png_write_image_8bit
      - debian/patches/CVE-2025-64720.patch: Fix a buffer overflow in
        png_init_read_transformations
      - debian/patches/CVE-2025-65018.patch: Fix a heap buffer overflow in
        png_image_finish_read
      - CVE-2025-64505
      - CVE-2025-64506
      - CVE-2025-64720
      - CVE-2025-65018

   -- Nishit Majithia <[email protected]>  Tue, 09 Dec 2025 17:35:45 +0530

libtasn1-6:amd64 (built from libtasn1-6) updated from 4.18.0-4ubuntu0.1 to 4.18.0-4ubuntu0.2:

  libtasn1-6 (4.18.0-4ubuntu0.2) jammy-security; urgency=medium

    * SECURITY UPDATE: ETYPE_OK off-by-one array size check
      - debian/patches/CVE-2021-46848.patch: fix size check in lib/int.h.
      - CVE-2021-46848
    * SECURITY UPDATE: Stack-based buffer overflow
      - debian/patches/CVE-2025-13151.patch: fix asn1_expand_octet_string
        buffer size in lib/decoding.c.
      - CVE-2025-13151

   -- Marc Deslauriers <[email protected]>  Thu, 08 Jan 2026 12:27:15 -0500

python3-attr (built from python-attrs) updated from 21.2.0-1 to 21.2.0-1ubuntu1:

  python-attrs (21.2.0-1ubuntu1) jammy; urgency=medium

    * d/p/0005-Rework-linecache-handling-828.patch: Cherry-pick upstream PR 826 
      - Fix memory leak when creating many identical classes (Fixes LP: #2121607)

   -- Zachary Raines <[email protected]>  Mon, 06 Oct 2025 15:28:54 +0000

python3-urllib3 (built from python-urllib3) updated from 1.26.5-1~exp1ubuntu0.3 to 1.26.5-1~exp1ubuntu0.5:

  python-urllib3 (1.26.5-1~exp1ubuntu0.5) jammy-security; urgency=medium

    * SECURITY UPDATE: Decompression bomb in HTTP redirect responses.
      - debian/patches/CVE-2026-21441.patch: Add decode_content to self.read()
        in src/urllib3/response.py. Add tests in
        test/with_dummyserver/test_connectionpool.py.
      - CVE-2026-21441

   -- Hlib Korzhynskyy <[email protected]>  Thu, 08 Jan 2026 16:06:10 -0330

  python-urllib3 (1.26.5-1~exp1ubuntu0.4) jammy-security; urgency=medium

    * SECURITY UPDATE: Denial of service due to unbounded decompression chain.
      - debian/patches/CVE-2025-66418.patch: Add max_decode_links limit and
        checks in src/urllib3/response.py. Add test in test/test_response.py.
      - CVE-2025-66418

   -- Hlib Korzhynskyy <[email protected]>  Wed, 10 Dec 2025 17:29:42 -0330

libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.12 to 3.10.12-1~22.04.13:

  python3.10 (3.10.12-1~22.04.13) jammy-security; urgency=medium

    * SECURITY UPDATE: HTTP Content-Length denial of service
      - debian/patches/CVE-2025-13836.patch: Read large data in chunks with
        geometric reads in Lib/http/client.py and add tests in 
        Lib/test/test_httplib.py
      - CVE-2025-13836

   -- Vyom Yadav <[email protected]>  Thu, 08 Jan 2026 12:22:19 +0530

02/12/2025, commit https://github.com/canonical/core-base/tree/e66d98a0d2aa893b0907dd3bbe9db09c3d274c5d

[ Changes in the core22 snap ]

No detected changes for the core22 snap

[ Changes in primed packages ]

libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.11 to 3.10.12-1~22.04.12:

  python3.10 (3.10.12-1~22.04.12) jammy-security; urgency=medium

    * SECURITY UPDATE: Possible payload obfuscation
      - debian/patches/CVE-2025-8291.patch: check consistency of
        the zip64 end of central dir record in Lib/zipfile.py,
        Lib/test/test_zipfile.py.
      - CVE-2025-8291
    * SECURITY UPDATE: Performance degradation
      - debian/patches/CVE-2025-6075.patch: fix quadratic complexity
        in os.path.expandvars() in Lib/ntpatch.py, Lib/posixpath.py,
        Lib/test/test_genericpatch.py, Lib/test/test_npath.py.
      - CVE-2025-6075

   -- Leonidas Da Silva Barbosa <[email protected]>  Tue, 04 Nov 2025 05:48:33 -0300

05/11/2025, commit https://github.com/canonical/core-base/tree/e66d98a0d2aa893b0907dd3bbe9db09c3d274c5d

[ Changes in the core22 snap ]

Philip Meulengracht (1):
      github: add fips release builds (#378)

[ Changes in primed packages ]

distro-info-data (built from distro-info-data) updated from 0.52ubuntu0.9 to 0.52ubuntu0.11:

  distro-info-data (0.52ubuntu0.11) jammy; urgency=medium

    * ubuntu.csv: remove eol-legacy field from resolute
      This version of distro-info does not know about eol-legacy.

   -- Nick Rosbrook <[email protected]>  Fri, 10 Oct 2025 11:59:51 -0400

  distro-info-data (0.52ubuntu0.10) jammy; urgency=medium

    * Add Ubuntu 26.04 LTS "Resolute Raccoon" (LP: #2126961)
    * Correct date for forky
    * Correct estimation for trixie ELTS EoL to 10 years total support.
    * Update the bookworm EoL

   -- Florent 'Skia' Jacquet <[email protected]>  Fri, 10 Oct 2025 11:33:51 +0100

libssh-4:amd64 (built from libssh) updated from 0.9.6-2ubuntu0.22.04.4 to 0.9.6-2ubuntu0.22.04.5:

  libssh (0.9.6-2ubuntu0.22.04.5) jammy-security; urgency=medium

    * SECURITY UPDATE: NULL pointer dereference
      - debian/patches/CVE-2025-8114.patch: sets rc to SSH_ERROR prior to goto
        error in ssh_make_sessionid() of src/kex.c.
      - CVE-2025-8114

   -- Ian Constantin <[email protected]>  Wed, 29 Oct 2025 14:58:26 +0200

09/10/2025, commit https://github.com/canonical/core-base/tree/6174ae97e09857c5e7e38f2a0599c7d2940acddf

[ Changes in the core22 snap ]

No detected changes for the core22 snap

[ Changes in primed packages ]

cloud-init (built from cloud-init) updated from 25.1.4-0ubuntu0~22.04.1 to 25.2-0ubuntu1~22.04.1:

  cloud-init (25.2-0ubuntu1~22.04.1) jammy; urgency=medium

    * refresh patches
      - d/p/cli-retain-file-argument-as-main-cmd-arg.patch
      - d/p/deprecation-version-boundary.patch
      - d/p/grub-dpkg-support.patch
      - d/p/keep-dhclient-as-priority-client.patch
      - d/p/no-nocloud-network.patch
      - d/p/no-remove-networkd-online.patch
      - d/p/no-single-process.patch
      - d/p/retain-ec2-default-net-update-events.patch
      - d/p/retain-old-groups.patch
      - d/p/revert-551f560d-cloud-config-after-snap-seeding.patch
    * add d/p/strip-invalid-mtu.patch
      - Provides backwards compatibility for an other invalid
        MTU in a netplan config. (GH-6239)
    * Upstream snapshot based on 25.2. (LP: #2120495).
      List of changes from upstream can be found at
      https://raw.githubusercontent.com/canonical/cloud-init/25.2/ChangeLog

   -- James Falcon <[email protected]>  Tue, 12 Aug 2025 14:48:04 -0500

dpkg (built from dpkg) updated from 1.21.1ubuntu2.3 to 1.21.1ubuntu2.6:

  dpkg (1.21.1ubuntu2.6) jammy-security; urgency=medium

    [ Joy Latten ]
    * SECURITY UPDATE:
    - Fix cleanup for control member with restricted directories. LP: #2122053
    - Fixes CVE-2025-6297

   -- Serge Hallyn <[email protected]>  Tue, 09 Sep 2025 15:09:16 -0500

libssl3:amd64, openssl (built from openssl) updated from 3.0.2-0ubuntu1.19 to 3.0.2-0ubuntu1.20:

  openssl (3.0.2-0ubuntu1.20) jammy-security; urgency=medium

    * SECURITY UPDATE: Out-of-bounds read & write in RFC 3211 KEK Unwrap
      - debian/patches/CVE-2025-9230.patch: fix incorrect check of unwrapped
        key size in crypto/cms/cms_pwri.c.
      - CVE-2025-9230

   -- Marc Deslauriers <[email protected]>  Thu, 18 Sep 2025 08:06:16 -0400

libpam-systemd:amd64, libsystemd0:amd64, libudev1:amd64, systemd, systemd-sysv, systemd-timesyncd, udev (built from systemd) updated from 249.11-0ubuntu3.16 to 249.11-0ubuntu3.17:

  systemd (249.11-0ubuntu3.17) jammy; urgency=medium

    [ Nick Rosbrook ]
    * initramfs-tools: copy hwdb.bin to initramfs (LP: #2112237)
    * d/t/tests-in-lxd: drop patching workaround (LP: #2115263)
      - d/t/control: add Depends: dnsmasq-base
        (Revealed by test progressing past previous failure)

    [ Chengen Du ]
    * core/device: fix devlink handling (LP: #2100252)

   -- Nick Rosbrook <[email protected]>  Tue, 26 Aug 2025 11:23:06 -0400

wpasupplicant (built from wpa) updated from 2:2.10-6ubuntu2.2 to 2:2.10-6ubuntu2.3:

  wpa (2:2.10-6ubuntu2.3) jammy; urgency=medium

    * Bump DEFAULT_BSS_MAX_COUNT to 1000 (LP: #2117180)

   -- Mitchell Augustin <[email protected]>  Mon, 21 Jul 2025 18:13:31 -0500

23/09/2025, commit https://github.com/canonical/core-base/tree/6174ae97e09857c5e7e38f2a0599c7d2940acddf

[ Changes in the core22 snap ]

No detected changes for the core22 snap

[ Changes in primed packages ]

libc-bin, libc6:amd64, libc6:i386 (built from glibc) updated from 2.35-0ubuntu3.10 to 2.35-0ubuntu3.11:

  glibc (2.35-0ubuntu3.11) jammy-security; urgency=medium

    * SECURITY UPDATE: double-free in regcomp function
      - debian/patches/any/CVE-2025-8058.patch: fix double-free after
        allocation failure in regcomp in posix/Makefile, posix/regcomp.c,
        posix/tst-regcomp-bracket-free.c.
      - CVE-2025-8058

   -- Marc Deslauriers <[email protected]>  Wed, 17 Sep 2025 11:26:08 -0400

22/08/2025, commit https://github.com/canonical/core-base/tree/6174ae97e09857c5e7e38f2a0599c7d2940acddf

[ Changes in the core22 snap ]

Alfonso Sánchez-Beato (3):
      .github/workflows: add release-manual action
      .github/workflows/tests.yaml: make sure to run on spread-enabled runners
      many: ser snap version from date tag if present

[ Changes in primed packages ]

gcc-12-base:amd64, gcc-12-base:i386, libgcc-s1:amd64, libgcc-s1:i386, libstdc++6:amd64 (built from gcc-12) updated from 12.3.0-1ubuntu1~22.04 to 12.3.0-1ubuntu1~22.04.2:

  gcc-12 (12.3.0-1ubuntu1~22.04.2) jammy-security; urgency=medium

    * SECURITY UPDATE: A missed hardening option in -fstack-protector for AArch64
      can lead to buffer overflows for dynamically allocated local variables 
      not being detected. (LP: #2054343)
      - d/p/CVE-2023-4039.diff: Address stack protector and stack clash
        protection weaknesses on AArch64. Taken from the gcc-12 branch. 
      - CVE-2023-4039
    * Move allocator base to avoid conflict with high-entropy ASLR for x86-64
      Linux. Patch taken from LLVM. Fixes ftbfs. (LP: #2107313)
      - d/p/lp2107313-asan-allocator-base.diff
    * aarch64: Fix loose ldpstp check. (LP: #2116909)
      - d/p/lp2116909-aarch64-fix-loose-ldpstp-check.diff

   -- Gerald Yang <[email protected]>  Tue, 15 Jul 2025 03:45:40 +0000

libglib2.0-0:amd64 (built from glib2.0) updated from 2.72.4-0ubuntu2.5 to 2.72.4-0ubuntu2.6:

  glib2.0 (2.72.4-0ubuntu2.6) jammy; urgency=medium

    * Fix crash due to infinite recursion in MIME subclassing (LP: #2097496)

   -- Alessandro Astone <[email protected]>  Fri, 20 Jun 2025 15:38:50 +0200

libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.10 to 3.10.12-1~22.04.11:

  python3.10 (3.10.12-1~22.04.11) jammy-security; urgency=medium

    * SECURITY UPDATE: Regular expression denial of service.
      - debian/patches/CVE-2025-6069.patch: Improve regex parsing in
        Lib/html/parser.py.
      - CVE-2025-6069
    * SECURITY UPDATE: Infinite loop when parsing tar archives.
      - debian/patches/CVE-2025-8194.patch: Raise exception when count < 0 in
        Lib/tarfile.py.
      - CVE-2025-8194

   -- Hlib Korzhynskyy <[email protected]>  Fri, 15 Aug 2025 12:02:43 -0230

30/07/2025, commit https://git.launchpad.net/snap-core22/tree/5915fa29307f6839820c681cf666367c164d1088

[ Changes in the core22 snap ]

No detected changes for the core22 snap

[ Changes in primed packages ]

cloud-init (built from cloud-init) updated from 25.1.2-0ubuntu0~22.04.2 to 25.1.4-0ubuntu0~22.04.1:

  cloud-init (25.1.4-0ubuntu0~22.04.1) jammy-security; urgency=medium

    * refresh patches:
      - d/p/revert-usr-lib-systemd-units.patch
    * Upstream snapshot based on 25.1.4.
      List of changes from upstream can be found at
      https://raw.githubusercontent.com/canonical/cloud-init/25.1.4/ChangeLog
      - Bugs fixed in this snapshot:
        + fix: disable cloud-init when non-x86 environments have no DMI-data
          and no strict datasources detected (LP: #2069607) (CVE-2024-6174)

   -- Chad Smith <[email protected]>  Tue, 24 Jun 2025 15:15:25 -0600

  cloud-init (25.1.3-0ubuntu0~22.04.1) jammy-security; urgency=medium

    * d/cloud-init-base.postinst: move existing hotplug-cmd fifo to root-only
      share dir (CVE-2024-11584)
    * Upstream security bugfix release based on 25.1.3.
      List of changes from upstream can be found at
      https://raw.githubusercontent.com/canonical/cloud-init/25.1.3/ChangeLog
      - Bugs fixed in this snapshot:
      - security: make hotplug socket only writable by root (LP: #2114229)
        (CVE-2024-11584)
      - security: make ds-identify behavior strict datasource discovery on
        non-x86 platforms without DMI data (LP: #2069607) (CVE-2024-6174)

   -- Chad Smith <[email protected]>  Thu, 12 Jun 2025 20:28:18 -0600

gnutls-bin, libgnutls30:amd64 (built from gnutls28) updated from 3.7.3-4ubuntu1.6 to 3.7.3-4ubuntu1.7:

  gnutls28 (3.7.3-4ubuntu1.7) jammy-security; urgency=medium

    * SECURITY UPDATE: double-free via otherName in the SAN
      - debian/patches/CVE-2025-32988.patch: avoid double free when exporting
        othernames in SAN in lib/x509/extensions.c.
      - CVE-2025-32988
    * SECURITY UPDATE: OOB read via malformed length field in SCT extension
      - debian/patches/CVE-2025-32989.patch: fix read buffer overrun in SCT
        timestamps in lib/x509/x509_ext.c.
      - CVE-2025-32989
    * SECURITY UPDATE: heap write overflow in certtool via invalid template
      - debian/patches/CVE-2025-32990.patch: avoid 1-byte write buffer
        overrun when parsing template in src/certtool-cfg.c,
        tests/cert-tests/Makefile.am, tests/cert-tests/template-test.sh,
        tests/cert-tests/templates/template-too-many-othernames.tmpl.
      - CVE-2025-32990
    * SECURITY UPDATE: NULL deref via missing PSK in TLS 1.3 handshake
      - debian/patches/CVE-2025-6395.patch: clear HSK_PSK_SELECTED when
        resetting binders in lib/handshake.c, lib/state.c, tests/Makefile.am,
        tests/tls13/hello_retry_request_psk.c.
      - CVE-2025-6395

   -- Marc Deslauriers <[email protected]>  Fri, 11 Jul 2025 09:13:17 -0400

iputils-ping (built from iputils) updated from 3:20211215-1 to 3:20211215-1ubuntu0.1:

  iputils (3:20211215-1ubuntu0.1) jammy-security; urgency=medium

    * SECURITY UPDATE: DoS via crafted ICMP Echo Reply packet
      - debian/patches/CVE-2025-47268: fix signed 64-bit integer overflow in
        RTT calculation in iputils_common.h, ping/ping_common.c.
      - debian/patches/CVE-2025-48964.patch: fix moving average rtt
        calculation in iputils_common.h, ping/ping.h, ping/ping_common.c.
      - CVE-2025-47268
      - CVE-2025-48964

   -- Marc Deslauriers <[email protected]>  Thu, 24 Jul 2025 07:51:44 -0400

perl-base (built from perl) updated from 5.34.0-3ubuntu1.4 to 5.34.0-3ubuntu1.5:

  perl (5.34.0-3ubuntu1.5) jammy-security; urgency=medium

    * SECURITY UPDATE: threads race condition in file operations
      - debian/patches/fixes/CVE-2025-40909-metaconfig.diff: check for
        fdopendir in regen-configure/U/perl/d_fdopendir.U.
      - debian/patches/fixes/CVE-2025-40909-1.diff: clone dirhandles without
        fchdir in Configure, Cross/config.sh-arm-linux,
        Cross/config.sh-arm-linux-n770, Porting/Glossary, Porting/config.sh,
        config_h.SH, configure.com, plan9/config_sh.sample, sv.c,
        t/op/threads-dirh.t, win32/config.gc, win32/config.vc.
      - debian/patches/fixes/CVE-2025-40909-2.diff: minor corrections in
        Cross/config.sh-arm-linux, Cross/config.sh-arm-linux-n770,
        config_h.SH,plan9/config_sh.sample.
      - debian/patches/fixes/CVE-2025-40909-3.diff: use PerlLIO_dup_cloexec
        in Perl_dirp_dup to set O_CLOEXEC in sv.c.
      - debian/patches/fixes/CVE-2025-40909-metaconfig-reorder.diff: slightly
        reorder Configure and config_h.SH to match metaconfig output in
        Configure, config_h.SH.
      - debian/patches/fixes/CVE-2025-40909-generated.diff: update generated
        files and checksums in uconfig.sh, uconfig64.sh, uconfig.h,
        NetWare/config.wc.
      - CVE-2025-40909

   -- Marc Deslauriers <[email protected]>  Fri, 25 Jul 2025 13:26:40 -0400

libsqlite3-0:amd64 (built from sqlite3) updated from 3.37.2-2ubuntu0.4 to 3.37.2-2ubuntu0.5:

  sqlite3 (3.37.2-2ubuntu0.5) jammy-security; urgency=medium

    * SECURITY UPDATE: Memory corruption via number of aggregate terms
      - debian/patches/CVE-2025-6965.patch: raise an error right away if the
        number of aggregate terms in a query exceeds the maximum number of
        columns in src/expr.c, src/sqliteInt.h.
      - CVE-2025-6965

   -- Marc Deslauriers <[email protected]>  Fri, 18 Jul 2025 11:17:24 -0400

08/07/2025, commit https://git.launchpad.net/snap-core22/tree/5915fa29307f6839820c681cf666367c164d1088

[ Changes in the core22 snap ]

Philip Meulengracht (1):
      tools: aggregate old changelogs

[ Changes in primed packages ]

gpgv (built from gnupg2) updated from 2.2.27-3ubuntu2.3 to 2.2.27-3ubuntu2.4:

  gnupg2 (2.2.27-3ubuntu2.4) jammy-security; urgency=medium

    * debian/patches/fix-key-validity-regression-due-to-CVE-2025-
      30258.patch:
      - Fix a key validity regression following patches for CVE-2025-30258,
        causing trusted "certify-only" primary keys to be ignored when checking
        signature on user IDs and computing key validity. This regression makes
        imported keys signed by a trusted "certify-only" key have an unknown
        validity (LP: #2114775).

   -- dcpi <dcpi@u22vm>  Wed, 25 Jun 2025 13:54:28 +0000

libssh-4:amd64 (built from libssh) updated from 0.9.6-2ubuntu0.22.04.3 to 0.9.6-2ubuntu0.22.04.4:

  libssh (0.9.6-2ubuntu0.22.04.4) jammy-security; urgency=medium

    * SECURITY UPDATE: Write beyond bounds in binary to base64 conversion
      functions
      - debian/patches/CVE-2025-4877.patch: prevent integer overflow and
        potential OOB.
      - CVE-2025-4877
    * SECURITY UPDATE: Use of uninitialized variable in
      privatekey_from_file()
      - debian/patches/CVE-2025-4878-1.patch: initialize pointers where
        possible.
      - debian/patches/CVE-2025-4878-2.patch: properly check return value to
        avoid NULL pointer dereference.
      - CVE-2025-4878
    * SECURITY UPDATE: OOB read in sftp_handle function
      - debian/patches/CVE-2025-5318.patch: fix possible buffer overrun.
      - CVE-2025-5318
    * SECURITY UPDATE: ssh_kdf() returns a success code on certain failures
      - debian/patches/CVE-2025-5372-pre1.patch: Reformat ssh_kdf().
      - debian/patches/CVE-2025-5372.patch: simplify error checking and
        handling of return codes in ssh_kdf().
      - CVE-2025-5372
    * SECURITY UPDATE: Missing packet filter may expose to variant of
      Terrapin attack
      - debian/patches/missing_packet_filter.patch: implement missing packet
        filter for DH GEX.
      - No CVE number

   -- Marc Deslauriers <[email protected]>  Wed, 02 Jul 2025 14:48:47 -0400

libpam-modules-bin, libpam-modules:amd64, libpam-runtime, libpam0g:amd64 (built from pam) updated from 1.4.0-11ubuntu2.5 to 1.4.0-11ubuntu2.6:

  pam (1.4.0-11ubuntu2.6) jammy-security; urgency=medium

    * SECURITY UPDATE: privilege escalation via pam_namespace
      - debian/patches-applied/pam_namespace_170.patch: sync pam_namespace
        module to version 1.7.0.
      - debian/patches-applied/pam_namespace_post170-*.patch: add post-1.7.0
        changes from upstream git tree.
      - debian/patches-applied/pam_namespace_revert_abi.patch: revert ABI
        change to prevent unintended issues in running daemons.
      - debian/patches-applied/CVE-2025-6020-1.patch: fix potential privilege
        escalation.
      - debian/patches-applied/CVE-2025-6020-2.patch: add flags to indicate
        path safety.
      - debian/patches-applied/CVE-2025-6020-3.patch: secure_opendir: do not
        look at the group ownership.
      - debian/patches-applied/CVE-2024-22365.patch: removed, included in
        patch cluster above.
      - CVE-2025-6020

   -- Marc Deslauriers <[email protected]>  Thu, 12 Jun 2025 10:45:28 -0400

python3-urllib3 (built from python-urllib3) updated from 1.26.5-1~exp1ubuntu0.2 to 1.26.5-1~exp1ubuntu0.3:

  python-urllib3 (1.26.5-1~exp1ubuntu0.3) jammy-security; urgency=medium

    * SECURITY UPDATE: Information disclosure through improperly disabled
      redirects.
      - debian/patches/CVE-2025-50181.patch: Add "retries" check and set retries
        to Retry.from_int(retries, redirect=False) as well as set
        raise_on_redirect in ./src/urllib3/poolmanager.py.
      - CVE-2025-50181

   -- Hlib Korzhynskyy <[email protected]>  Mon, 23 Jun 2025 17:07:25 -0230

libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.9 to 3.10.12-1~22.04.10:

  python3.10 (3.10.12-1~22.04.10) jammy-security; urgency=medium

    * SECURITY UPDATE: incorrect address list folding
      - debian/patches/CVE-2025-1795-1.patch: don't encode list separators in
        Lib/email/_header_value_parser.py,
        Lib/test/test_email/test__header_value_parser.py.
      - debian/patches/CVE-2025-1795-2.patch: fix AttributeError in the email
        module in Lib/email/_header_value_parser.py,
        Lib/test/test_email/test__header_value_parser.py.
      - CVE-2025-1795
    * SECURITY UPDATE: DoS via bytes.decode with unicode_escape
      - debian/patches/CVE-2025-4516.patch: fix use-after-free in the
        unicode-escape decoder with an error handler in
        Include/cpython/bytesobject.h, Include/cpython/unicodeobject.h,
        Lib/test/test_codeccallbacks.py, Lib/test/test_codecs.py,
        Objects/bytesobject.c, Objects/unicodeobject.c,
        Parser/string_parser.c.
      - CVE-2025-4516

   -- Marc Deslauriers <[email protected]>  Tue, 27 May 2025 13:12:29 -0400

python3-requests (built from requests) updated from 2.25.1+dfsg-2ubuntu0.1 to 2.25.1+dfsg-2ubuntu0.3:

  requests (2.25.1+dfsg-2ubuntu0.3) jammy-security; urgency=medium

    * SECURITY UPDATE: Information Leak
      - debian/patches/CVE-2024-47081.patch: Only use hostname to do netrc
        lookup instead of netloc
      - CVE-2024-47081

   -- Bruce Cable <[email protected]>  Wed, 11 Jun 2025 13:27:31 +1000

sudo (built from sudo) updated from 1.9.9-1ubuntu2.4 to 1.9.9-1ubuntu2.5:

  sudo (1.9.9-1ubuntu2.5) jammy-security; urgency=medium

    * SECURITY UPDATE: Local Privilege Escalation via host option
      - debian/patches/CVE-2025-32462.patch: only allow specifying a host
        when listing privileges.
      - CVE-2025-32462

   -- Marc Deslauriers <[email protected]>  Wed, 25 Jun 2025 08:48:23 -0400

12/06/2025, commit https://git.launchpad.net/snap-core22/tree/7c3b8a59559a1d01f35830501a6ef478213ae767

[ Changes in the core22 snap ]

No detected changes for the core22 snap

[ Changes in primed packages ]

libapt-pkg6.0:amd64 (built from apt) updated from 2.4.13 to 2.4.14:

  apt (2.4.14) jammy; urgency=medium

    * Fix buffer overflow, stack overflow, exponential complexity in
      apt-ftparchive Contents generation (LP: #2083697)
      - ftparchive: Mystrdup: Add safety check and bump buffer size
      - ftparchive: contents: Avoid exponential complexity and overflows
      - test framework: Improve valgrind support
      - test: Check that apt-ftparchive handles deep paths
      - increase valgrind cleanliness to make the tests pass
        - pkgcachegen: Use placement new to construct header
        - Workaround valgrind "invalid read" in ExtractTar::Go by moving large
          buffer from stack to heap. The large buffer triggered some bugs in
          valgrind stack clash protection handling.

   -- Julian Andres Klode <[email protected]>  Tue, 22 Oct 2024 15:09:58 +0200

cloud-init (built from cloud-init) updated from 24.4.1-0ubuntu0~22.04.2 to 25.1.2-0ubuntu0~22.04.2:

  cloud-init (25.1.2-0ubuntu0~22.04.2) jammy; urgency=medium

    * New bugfix release. (LP: #2113797)
      - Revert relocation of systemd units and service files from /usr/lib
        back to /lib so debhelper correctly enables cloud-init services in
        postinst

   -- Chad Smith <[email protected]>  Mon, 09 Jun 2025 17:00:37 -0600

  cloud-init (25.1.2-0ubuntu0~22.04.1) jammy; urgency=medium

    * Upstream snapshot based on 25.1.2. (LP: #2104165).
      List of changes from upstream can be found at
      https://raw.githubusercontent.com/canonical/cloud-init/25.1.2/ChangeLog

   -- James Falcon <[email protected]>  Fri, 02 May 2025 12:47:51 -0500

  cloud-init (25.1.1-0ubuntu1~22.04.1) jammy; urgency=medium

    * Drop cpicks which are now upstream:
      - d/p/cpick-d75840be-fix-retry-AWS-hotplug-for-async-IMDS-5995
      - d/p/cpick-84806336-chore-Add-feature-flag-for-manual-network-waiting
      - d/p/cpick-c60771d8-test-pytestify-test_url_helper.py
      - d/p/cpick-8810a2dc-test-Remove-CiTestCase-from-test_url_helper.py
      - d/p/cpick-582f16c1-test-add-OauthUrlHelper-tests
      - d/p/cpick-9311e066-fix-Update-OauthUrlHelper-to-use-readurl-exception_cb
    * refresh patches
      - d/p/deprecation-version-boundary.patch
      - d/p/no-single-process.patch
      - d/p/retain-ec2-default-net-update-events.patch
      - d/p/revert-551f560d-cloud-config-after-snap-seeding.patch
    * sort hunks within all patches (--sort on quilt refresh)
    * d/cloud-init.templates:
      - Move VMware before OVF. See GH-4030
      - Enable CloudCIX by default
    * Upstream snapshot based on 25.1.1.
      List of changes from upstream can be found at
      https://raw.githubusercontent.com/canonical/cloud-init/25.1.1/ChangeLog

   -- Chad Smith <[email protected]>  Tue, 25 Mar 2025 10:33:28 -0600

python3-pkg-resources, python3-setuptools (built from setuptools) updated from 59.6.0-1.2ubuntu0.22.04.2 to 59.6.0-1.2ubuntu0.22.04.3:

  setuptools (59.6.0-1.2ubuntu0.22.04.3) jammy-security; urgency=medium

    * SECURITY UPDATE: path traversal vulnerability
      - debian/patches/CVE-2025-47273-pre1.patch: Extract
        _resolve_download_filename with test.
      - debian/patches/CVE-2025-47273.patch: Add a check to ensure the name
        resolves relative to the tmpdir.
      - CVE-2025-47273

   -- Fabian Toepfer <[email protected]>  Wed, 28 May 2025 19:13:58 +0200

libpam-systemd:amd64, libsystemd0:amd64, libudev1:amd64, systemd, systemd-sysv, systemd-timesyncd, udev (built from systemd) updated from 249.11-0ubuntu3.15 to 249.11-0ubuntu3.16:

  systemd (249.11-0ubuntu3.16) jammy-security; urgency=medium

    * SECURITY UPDATE: race condition in systemd-coredump
      - debian/patches/CVE_2025_4598_1.patch: coredump: get rid of
        _META_MANDATORY_MAX.
      - debian/patches/CVE_2025_4598_2.patch: coredump: use %d in kernel core
        pattern.
      - debian/patches/CVE_2025_4598_3.patch: coredump: get rid of a bogus
        assertion.
      - CVE-2025-4598

   -- Octavio Galland <[email protected]>  Wed, 04 Jun 2025 11:17:43 -0300