[USN-8112-4] Linux kernel (Azure FIPS) vulnerabilities
[USN-8112-3] Linux kernel (Azure) vulnerabilities
[USN-8059-9] Linux kernel (Azure FIPS) vulnerabilities
[USN-8098-4] Linux kernel vulnerabilities
[USN-8098-6] Linux kernel (FIPS) vulnerabilities
[USN-8098-5] Linux kernel vulnerabilities
[USN-8120-1] Redis vulnerability
[USN-8112-5] Linux kernel (Azure) vulnerabilities
[USN-8121-1] Linux kernel (AWS FIPS) vulnerability
[USN-8122-1] PJSIP vulnerabilities
[USN-8112-4] Linux kernel (Azure FIPS) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8112-4
March 24, 2026
linux-azure-fips vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure-fips: Linux kernel for Microsoft Azure Cloud systems with FIPS
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- MMC subsystem;
- Network drivers;
- USB Device Class drivers;
- BTRFS file system;
- HFS+ file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Simplified Mandatory Access Control Kernel framework;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56581, CVE-2024-56593,
CVE-2025-21704, CVE-2025-40215)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
linux-image-4.15.0-2106-azure-fips 4.15.0-2106.112
Available with Ubuntu Pro
linux-image-azure-fips 4.15.0.2106.102
Available with Ubuntu Pro
linux-image-azure-fips-4.15 4.15.0.2106.102
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8112-4
https://ubuntu.com/security/notices/USN-8112-3
https://ubuntu.com/security/notices/USN-8112-2
https://ubuntu.com/security/notices/USN-8112-1
CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56581, CVE-2024-56593,
CVE-2025-21704, CVE-2025-40215
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure-fips/4.15.0-2106.112
[USN-8112-3] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8112-3
March 24, 2026
linux-azure, linux-azure-4.15 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- MMC subsystem;
- Network drivers;
- USB Device Class drivers;
- BTRFS file system;
- HFS+ file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Simplified Mandatory Access Control Kernel framework;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56581, CVE-2024-56593,
CVE-2025-21704, CVE-2025-40215)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
linux-image-4.15.0-1197-azure 4.15.0-1197.212
Available with Ubuntu Pro
linux-image-azure-4.15 4.15.0.1197.165
Available with Ubuntu Pro
linux-image-azure-lts-18.04 4.15.0.1197.165
Available with Ubuntu Pro
Ubuntu 16.04 LTS
linux-image-4.15.0-1197-azure 4.15.0-1197.212~16.04.1
Available with Ubuntu Pro
linux-image-azure 4.15.0.1197.212~16.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8112-3
https://ubuntu.com/security/notices/USN-8112-2
https://ubuntu.com/security/notices/USN-8112-1
CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56581, CVE-2024-56593,
CVE-2025-21704, CVE-2025-40215
[USN-8059-9] Linux kernel (Azure FIPS) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8059-9
March 24, 2026
linux-azure-fips vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure-fips: Linux kernel for Microsoft Azure Cloud systems with FIPS
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SMB network file system;
(CVE-2025-22037, CVE-2025-37899)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
linux-image-6.8.0-1047-azure-fips 6.8.0-1047.53+fips1
Available with Ubuntu Pro
linux-image-azure-fips 6.8.0-1047.53+fips1
Available with Ubuntu Pro
linux-image-azure-fips-6.8 6.8.0-1047.53+fips1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8059-9
https://ubuntu.com/security/notices/USN-8059-8
https://ubuntu.com/security/notices/USN-8059-7
https://ubuntu.com/security/notices/USN-8059-6
https://ubuntu.com/security/notices/USN-8059-5
https://ubuntu.com/security/notices/USN-8059-4
https://ubuntu.com/security/notices/USN-8059-3
https://ubuntu.com/security/notices/USN-8059-2
https://ubuntu.com/security/notices/USN-8059-1
CVE-2025-22037, CVE-2025-37899
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure-fips/6.8.0-1047.53+fips1
[USN-8098-4] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8098-4
March 24, 2026
linux-hwe-5.4, linux-ibm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-ibm: Linux kernel for IBM cloud systems
- linux-hwe-5.4: Linux hardware enablement (HWE) kernel
Details:
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- GPIO subsystem;
- GPU drivers;
- MMC subsystem;
- BTRFS file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- SMC sockets;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49072, CVE-2022-49267,
CVE-2024-49927, CVE-2024-56640, CVE-2025-21780, CVE-2025-40215)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
linux-image-5.4.0-1102-ibm 5.4.0-1102.107
Available with Ubuntu Pro
linux-image-ibm-5.4 5.4.0.1102.131
Available with Ubuntu Pro
linux-image-ibm-lts-20.04 5.4.0.1102.131
Available with Ubuntu Pro
Ubuntu 18.04 LTS
linux-image-5.4.0-227-generic 5.4.0-227.247~18.04.1
Available with Ubuntu Pro
linux-image-5.4.0-227-lowlatency 5.4.0-227.247~18.04.1
Available with Ubuntu Pro
linux-image-generic-5.4 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-generic-hwe-18.04 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-lowlatency-5.4 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-lowlatency-hwe-18.04 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-oem 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-oem-osp1 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-snapdragon-5.4 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-snapdragon-hwe-18.04 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-virtual-5.4 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
linux-image-virtual-hwe-18.04 5.4.0.227.247~18.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8098-4
https://ubuntu.com/security/notices/USN-8098-3
https://ubuntu.com/security/notices/USN-8098-2
https://ubuntu.com/security/notices/USN-8098-1
https://launchpad.net/bugs/2143853
CVE-2021-47599, CVE-2022-48875, CVE-2022-49072, CVE-2022-49267,
CVE-2024-49927, CVE-2024-56640, CVE-2025-21780, CVE-2025-40215,
[USN-8098-6] Linux kernel (FIPS) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8098-6
March 24, 2026
linux-fips, linux-gcp-fips vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-fips: Linux kernel with FIPS
- linux-gcp-fips: Linux kernel for Google Cloud Platform (GCP) systems with FIPS
Details:
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- GPIO subsystem;
- GPU drivers;
- MMC subsystem;
- BTRFS file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- SMC sockets;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49072, CVE-2022-49267,
CVE-2024-49927, CVE-2024-56640, CVE-2025-21780, CVE-2025-40215)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
linux-image-5.4.0-1130-fips 5.4.0-1130.140
Available with Ubuntu Pro
linux-image-5.4.0-1159-gcp-fips 5.4.0-1159.168+fips1
Available with Ubuntu Pro
linux-image-fips 5.4.0.1130.127
Available with Ubuntu Pro
linux-image-fips-5.4 5.4.0.1130.127
Available with Ubuntu Pro
linux-image-gcp-fips 5.4.0.1159.101
Available with Ubuntu Pro
linux-image-gcp-fips-5.4 5.4.0.1159.101
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8098-6
https://ubuntu.com/security/notices/USN-8098-5
https://ubuntu.com/security/notices/USN-8098-4
https://ubuntu.com/security/notices/USN-8098-3
https://ubuntu.com/security/notices/USN-8098-2
https://ubuntu.com/security/notices/USN-8098-1
https://launchpad.net/bugs/2143853
CVE-2021-47599, CVE-2022-48875, CVE-2022-49072, CVE-2022-49267,
CVE-2024-49927, CVE-2024-56640, CVE-2025-21780, CVE-2025-40215,
Package Information:
https://launchpad.net/ubuntu/+source/linux-fips/5.4.0-1130.140
https://launchpad.net/ubuntu/+source/linux-gcp-fips/5.4.0-1159.168+fips1
[USN-8098-5] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8098-5
March 24, 2026
linux-iot, linux-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-iot: Linux kernel for IoT platforms
- linux-kvm: Linux kernel for cloud environments
Details:
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- GPIO subsystem;
- GPU drivers;
- MMC subsystem;
- BTRFS file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- SMC sockets;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49072, CVE-2022-49267,
CVE-2024-49927, CVE-2024-56640, CVE-2025-21780, CVE-2025-40215)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
linux-image-5.4.0-1060-iot 5.4.0-1060.63
Available with Ubuntu Pro
linux-image-5.4.0-1143-kvm 5.4.0-1143.152
Available with Ubuntu Pro
linux-image-kvm 5.4.0.1143.139
Available with Ubuntu Pro
linux-image-kvm-5.4 5.4.0.1143.139
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8098-5
https://ubuntu.com/security/notices/USN-8098-4
https://ubuntu.com/security/notices/USN-8098-3
https://ubuntu.com/security/notices/USN-8098-2
https://ubuntu.com/security/notices/USN-8098-1
https://launchpad.net/bugs/2143853
CVE-2021-47599, CVE-2022-48875, CVE-2022-49072, CVE-2022-49267,
CVE-2024-49927, CVE-2024-56640, CVE-2025-21780, CVE-2025-40215,
[USN-8120-1] Redis vulnerability
==========================================================================
Ubuntu Security Notice USN-8120-1
March 24, 2026
redis vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
Summary:
Redis could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- redis: Persistent key-value database with network interface
Details:
Seunghyun Lee discovered that Redis incorrectly handled memory during
hyperloglog operations. An attacker could use this issue to cause a denial
of service, or possibly achieve remote code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
redis 5:7.0.15-1ubuntu0.24.04.3
redis-server 5:7.0.15-1ubuntu0.24.04.3
After a standard system update you need to restart redis to make all the
necessary changes.
References:
https://ubuntu.com/security/notices/USN-8120-1
CVE-2025-32023
Package Information:
https://launchpad.net/ubuntu/+source/redis/5:7.0.15-1ubuntu0.24.04.3
[USN-8112-5] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8112-5
March 24, 2026
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- MMC subsystem;
- Network drivers;
- USB Device Class drivers;
- BTRFS file system;
- HFS+ file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Simplified Mandatory Access Control Kernel framework;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56581, CVE-2024-56593,
CVE-2025-21704, CVE-2025-40215)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS
linux-image-4.15.0-1197-azure 4.15.0-1197.212~14.04.1
Available with Ubuntu Pro
linux-image-azure 4.15.0.1197.212~14.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8112-5
https://ubuntu.com/security/notices/USN-8112-4
https://ubuntu.com/security/notices/USN-8112-3
https://ubuntu.com/security/notices/USN-8112-2
https://ubuntu.com/security/notices/USN-8112-1
CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56581, CVE-2024-56593,
CVE-2025-21704, CVE-2025-40215
[USN-8121-1] Linux kernel (AWS FIPS) vulnerability
==========================================================================
Ubuntu Security Notice USN-8121-1
March 24, 2026
linux-aws-fips vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
The system could be made to run programs as an administrator.
Software Description:
- linux-aws-fips: Linux kernel for Amazon Web Services (AWS) systems with FIPS
Details:
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
linux-image-5.4.0-1156-aws-fips 5.4.0-1156.166+fips1
Available with Ubuntu Pro
linux-image-aws-fips 5.4.0.1156.103
Available with Ubuntu Pro
linux-image-aws-fips-5.4 5.4.0.1156.103
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8121-1
https://launchpad.net/bugs/2143853
Package Information:
https://launchpad.net/ubuntu/+source/linux-aws-fips/5.4.0-1156.166+fips1
[USN-8122-1] PJSIP vulnerabilities
==========================================================================
Ubuntu Security Notice USN-8122-1
March 24, 2026
pjproject vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in PJSIP.
Software Description:
- pjproject: multimedia communication library
Details:
Youngsung Kim discovered that PJSIP did not properly parse numeric header
fields in SIP messages. A remote attacker could use this issue to cause
PJSIP to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-16872)
Peter Koletzki discovered that PJSIP did not properly handle certain
connection requests. A remote attacker could possibly use this issue to
cause PJSIP to enter an unrecoverable state and reject further connections,
resulting in a denial of service. This issue only affected Ubuntu 16.04
LTS. (CVE-2017-16875)
Alfred Farrugia, Sandro Gauci, and Kevin Harwell discovered that PJSIP did
not properly parse certain SDP messages. A remote attacker could possibly
use this issue to cause PJSIP to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2018-1000098,
CVE-2018-1000099)
Lauri Vänskä discovered that PJSIP did not verify hostnames when reusing
TLS connections. If a remote attacker were able to intercept communication,
this flaw could possibly be exploited to view sensitive information.
(CVE-2020-15260)
It was discovered that PJSIP did not properly handle certain sequences of
SDP messages. A remote attacker could possibly use this issue to cause
PJSIP to crash, resulting in a denial of service. (CVE-2021-21375)
It was discovered that the SSL socket implementation in PJSIP contained a
race condition. A remote attacker could possibly use this issue to cause
PJSIP to crash, resulting in a denial of service. This issue was only
addressed in Ubuntu 18.04 LTS. (CVE-2021-32686)
It was discovered that PJSIP did not properly parse certain STUN messages.
A remote attacker could use this issue to cause PJSIP to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2021-37706)
Uriya Yavnieli discovered that PJSIP did not properly manage memory under
certain conditions. A remote attacker could use this issue to cause PJSIP
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302,
CVE-2021-43303)
It was discovered that PJSIP did not properly manage memory when processing
ICE session credentials. A remote attacker could use this issue to cause
PJSIP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-25994)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
libpj2 2.7.2~dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjmedia2 2.7.2~dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjnath2 2.7.2~dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjsip2 2.7.2~dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjsua2 2.7.2~dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
python-pjproject 2.7.2~dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
libpj2 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjmedia2 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjnath2 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjsip2 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1
Available with Ubuntu Pro
libpjsua2 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8122-1
CVE-2017-16872, CVE-2017-16875, CVE-2018-1000098, CVE-2018-1000099,
CVE-2020-15260, CVE-2021-21375, CVE-2021-32686, CVE-2021-37706,
CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302,
CVE-2021-43303, CVE-2026-25994
