[USN-8516-1] Apache HTTP Server vulnerabilities
[USN-8517-1] ClamAV vulnerabilities
[USN-8518-1] mailcap vulnerability
[USN-8516-1] Apache HTTP Server vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8516-1
July 08, 2026
apache2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in Apache HTTP Server.
Software Description:
- apache2: Apache HTTP server
Details:
It was discovered that Apache HTTP Server's mod_ldap module incorrectly
handled memory when processing per-directory configurations. An attacker
could use this issue to cause the server to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-29167)
It was discovered that Apache HTTP Server's mod_proxy_ftp module
incorrectly handled HTML generation for FTP directory listings. A remote
attacker could possibly use this issue to inject arbitrary web script or
HTML. (CVE-2026-29170)
It was discovered that Apache HTTP Server's mod_proxy_html module
incorrectly handled certain content from an untrusted backend. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. (CVE-2026-34355)
It was discovered that Apache HTTP Server incorrectly handled
ProxyPassReverseCookie directives with a malicious backend server. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. (CVE-2026-34356)
It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly
handled certain path operations. An authenticated user could possibly use
this issue to manipulate trusted WebDAV property databases or cause a
denial of service. (CVE-2026-42535)
It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly
handled certain content from an untrusted backend. A remote attacker could
possibly use this issue to cause Apache HTTP Server to crash, resulting in
a denial of service. (CVE-2026-42536)
It was discovered that Apache HTTP Server incorrectly handled response
headers when multiple content languages were configured. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2026-43951)
It was discovered that Apache HTTP Server incorrectly restricted certain
file functions in expressions within .htaccess files. A local attacker with
.htaccess write access could possibly use this issue to obtain sensitive
information. (CVE-2026-44119)
It was discovered that Apache HTTP Server's mod_ssl module incorrectly
handled OCSP responses from an attacker-controlled server. A remote
attacker could possibly use this issue to obtain sensitive information or
cause a denial of service. (CVE-2026-44185)
It was discovered that Apache HTTP Server's mod_proxy_ftp module
incorrectly handled responses from an attacker-controlled backend FTP
server. A remote attacker could possibly use this issue to cause Apache
HTTP Server to stop responding, resulting in a denial of service.
(CVE-2026-44186)
It was discovered that Apache HTTP Server incorrectly handled crafted
regular expressions in the server configuration. An attacker could possibly
use this issue to execute arbitrary code or cause a denial of service.
(CVE-2026-44631)
It was discovered that Apache HTTP Server's mod_http2 module had a
use-after-free vulnerability when file handles were exhausted. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. (CVE-2026-48913)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
apache2 2.4.66-2ubuntu2.4
Ubuntu 24.04 LTS
apache2 2.4.58-1ubuntu8.15
Ubuntu 22.04 LTS
apache2 2.4.52-1ubuntu4.23
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8516-1
CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913
Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.4.66-2ubuntu2.4
https://launchpad.net/ubuntu/+source/apache2/2.4.58-1ubuntu8.15
https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.23
[USN-8517-1] ClamAV vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8517-1
July 08, 2026
clamav vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in ClamAV.
Software Description:
- clamav: Anti-virus utility for Unix
Details:
It was discovered that ClamAV incorrectly handled certain PE files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2026-20213, CVE-2026-20214,
CVE-2026-20217)
It was discovered that ClamAV incorrectly handled certain 7z archive
files. A remote attacker could possibly use this issue to cause ClamAV to
crash, resulting in a denial of service. (CVE-2026-20215)
It was discovered that ClamAV incorrectly handled extraction limits for
certain InstallShield archives. A remote attacker could possibly use this
issue to cause ClamAV to use excessive resources, leading to a denial of
service. (CVE-2026-20216)
It was discovered that ClamAV incorrectly handled certain ALZ archive
files. A remote attacker could possibly use this issue to cause ClamAV to
crash, resulting in a denial of service. (CVE-2026-20243)
It was discovered that ClamAV incorrectly handled certain DMG files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2026-20244)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
clamav 1.5.3+dfsg-0ubuntu0.26.04.1
Ubuntu 24.04 LTS
clamav 1.5.3+dfsg-0ubuntu0.24.04.1
Ubuntu 22.04 LTS
clamav 1.5.3+dfsg-0ubuntu0.22.04.2
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-8517-1
CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243, CVE-2026-20244
Package Information:
https://launchpad.net/ubuntu/+source/clamav/1.5.3+dfsg-0ubuntu0.26.04.1
https://launchpad.net/ubuntu/+source/clamav/1.5.3+dfsg-0ubuntu0.24.04.1
https://launchpad.net/ubuntu/+source/clamav/1.5.3+dfsg-0ubuntu0.22.04.2
[USN-8518-1] mailcap vulnerability
==========================================================================
Ubuntu Security Notice USN-8518-1
July 08, 2026
mailcap vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
mailcap could allow applications to escape sandbox restrictions
Software Description:
- mailcap: Debian's mailcap system, and support programs
Details:
Aaron Rainbolt discovered that the cautious-launcher utility in the
mailcap package did not properly restrict the execution of certain
file types. An attacker could use this issue to escape a sandboxed
application and execute arbitrary code on the host operating system.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
mailcap 3.75ubuntu1.1
Ubuntu 25.10
mailcap 3.74ubuntu1.1
Ubuntu 24.04 LTS
mailcap 3.70+nmu1ubuntu1.24.04.1
Ubuntu 22.04 LTS
mailcap 3.70+nmu1ubuntu1.22.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8518-1
CVE-2026-10037
Package Information:
https://launchpad.net/ubuntu/+source/mailcap/3.75ubuntu1.1
https://launchpad.net/ubuntu/+source/mailcap/3.74ubuntu1.1
https://launchpad.net/ubuntu/+source/mailcap/3.70+nmu1ubuntu1.24.04.1
https://launchpad.net/ubuntu/+source/mailcap/3.70+nmu1ubuntu1.22.04.1
