[USN-7851-1] runC vulnerabilities
[USN-7859-1] Django vulnerabilities
[USN-7851-1] runC vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7851-1
November 04, 2025
runc-app, runc-stable vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 25.10
- Ubuntu 25.04
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in runC.
Software Description:
- runc-app: Open Container Project
- runc-stable: Open Container Project
Details:
Lei Wang and Li Fubang discovered that runC incorrectly handled masked
paths. An attacker could possibly replace a container's /dev/null
with a symlink to some other procfs file and possibly escape a container.
(CVE-2025-31133)
Lei Wang and Li Fubang discovered that runC incorrectly handled the
/dev/console bind-mounts. An attacker could potentially exploit this issue
to build-mount a symlink and escape a container. (CVE-2025-52565)
Li Fubang and Tõnis Tiigi discovered that the fix for CVE-2019-16884 was
incomplete. An attacker could possibly use this issue to cause a denial of
service or escape the container. (CVE-2025-52881)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 25.10
runc 1.3.3-0ubuntu1~25.10.2
runc-stable 1.3.3-0ubuntu1~25.10.2
Ubuntu 25.04
runc 1.3.3-0ubuntu1~25.04.2
Ubuntu 24.04 LTS
runc 1.3.3-0ubuntu1~24.04.2
Ubuntu 22.04 LTS
runc 1.3.3-0ubuntu1~22.04.2
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-7851-1
CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
Package Information:
https://launchpad.net/ubuntu/+source/runc-app/1.3.3-0ubuntu1~25.10.2
https://launchpad.net/ubuntu/+source/runc-stable/1.3.3-0ubuntu1~25.10.2
https://launchpad.net/ubuntu/+source/runc-app/1.3.3-0ubuntu1~25.04.2
https://launchpad.net/ubuntu/+source/runc-app/1.3.3-0ubuntu1~24.04.2
https://launchpad.net/ubuntu/+source/runc-app/1.3.3-0ubuntu1~22.04.2
[USN-7859-1] Django vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7859-1
November 05, 2025
python-django vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 25.10
- Ubuntu 25.04
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Django could be made to run programs if it received specially crafted
network traffic.
Software Description:
- python-django: High-level Python web development framework
Details:
It was discovered that Django incorrectly handled certain characters in
queries. An attacker could possibly use this issue to execute arbitrary SQL
commands.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 25.10
python3-django 3:5.2.4-1ubuntu2.1
Ubuntu 25.04
python3-django 3:4.2.18-1ubuntu1.6
Ubuntu 24.04 LTS
python3-django 3:4.2.11-1ubuntu1.12
Ubuntu 22.04 LTS
python3-django 2:3.2.12-2ubuntu1.23
Ubuntu 20.04 LTS
python3-django 2:2.2.12-1ubuntu0.29+esm5
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7859-1
CVE-2025-64459
Package Information:
https://launchpad.net/ubuntu/+source/python-django/3:5.2.4-1ubuntu2.1
https://launchpad.net/ubuntu/+source/python-django/3:4.2.18-1ubuntu1.6
https://launchpad.net/ubuntu/+source/python-django/3:4.2.11-1ubuntu1.12
https://launchpad.net/ubuntu/+source/python-django/2:3.2.12-2ubuntu1.23
