Several security issues were fixed in OpenStack Glance.. ========================================================================== Ubuntu Security Notice USN-8199-1 April 22, 2026 glance vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in OpenStack Glance. Software Description: - glance: OpenStack Image Registry and Delivery Service Details: Martin Kaesberger discovered that OpenStack Glance's image processing could return the contents of arbitrary files. An attacker could possibly use this issue to exfiltrate sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-32498) Hyeongeun Ji and Abhishek Kekane discovered several server-side request forgery vulnerabilities in OpenStack Glance's image import. An attacker could possibly use this issue to bypass URL validation checks and redirect to internal services. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-34881) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS glance 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro glance-api 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro glance-common 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro python3-glance 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS glance 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-api 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-common 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-registry 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro python-glance 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS glance 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-api 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-common 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-glare 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-registry 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro python-glance 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8199-1 CVE-2024-32498, CVE-2026-34881 . Review of Ubuntu's USN-8199-1 highlighting fixed security issues in OpenStack Glance affecting multiple LTS versions.. OpenStack Glance security, Ubuntu vulnerabilities, image processing issues. . Severity: Important. LinuxSecurity.com Team
Update to 9.6.0. Fixes rhbz#2452087. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-7de23151cd 2026-04-25 01:21:36.171214+00:00 -------------------------------------------------------------------------------- Name : calibre Product : Fedora 44 Version : 9.6.0 Release : 1.fc44 URL : https://calibre-ebook.com/ Summary : E-book converter and library manager Description : Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the concept of the logical book, i.e. a single entry in the database that may correspond to ebooks in several formats. It also supports conversion to and from a dozen different ebook formats. Supported input formats are: MOBI, LIT, PRC, EPUB, CHM, ODT, HTML, CBR, CBZ, RTF, TXT, PDF and LRS. -------------------------------------------------------------------------------- Update Information: Update to 9.6.0. Fixes rhbz#2452087 -------------------------------------------------------------------------------- ChangeLog: * Sun Mar 29 2026 Kevin Fenzi - 9.6.0-1 - Update to 9.6.0. Fixes rhbz#2452087 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2452087 - calibre-9.6.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2452087 [ 2 ] Bug #2452379 - CVE-2026-33205 calibre: server-side request forgery in ebook viewer backend [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452379 [ 3 ] Bug #2452380 - CVE-2026-33206 calibre: path traversal allows reading arbitrary files when converting a text-based file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452380 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-7de23151cd' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in server side request forgery or denial of service. CVE-2025-14178 Heap buffer overflow in array_merge().. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4447-1
Several vulnerabilities were discovered in python-urllib3, a HTTP library with thread-safe connection pooling for Python3, which could result in denial of service or request forgery. For the oldstable distribution (bookworm), these problems have been fixed in version 1.26.12-1+deb12u2.. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6102-1
Vulnerabilities were found in python-urllib3, an HTTP library with thread-safe connection pooling for Python, which could lead to denial of service or request forgery. CVE-2025-50181 Redirects were not disabled when retries are disabled on PoolManager. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4421-1
Python could allow Server-Side Request Forgery (SSRF) attacks.. ========================================================================== Ubuntu Security Notice USN-7280-2 May 22, 2025 python vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Python could allow Server-Side Request Forgery (SSRF) attacks. Software Description: - python3.13: An interactive high-level object-oriented language - python2.7: An interactive high-level object-oriented language - python3.11: An interactive high-level object-oriented language - python3.9: An interactive high-level object-oriented language - python3.6: An interactive high-level object-oriented language - python3.7: An interactive high-level object-oriented language - python3.8: An interactive high-level object-oriented language - python3.4: An interactive high-level object-oriented language Details: USN-7280-1 fixed a vulnerability in Python. This update provides the corresponding updates for some additional Python packages in Ubuntu releases. Original advisory details: It was discovered that Python incorrectly handled parsing domain names that included square brackets. A remote attacker could possibly use this issue to perform a Server-Side Request Forgery (SSRF) attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 python3.13 3.13.0-1ubuntu0.2 python3.13-minimal 3.13.0-1ubuntu0.2 Ubuntu 22.04 LTS python2.7 2.7.18-13ubuntu1.5+esm6 Available with Ubuntu Pro python2.7-minimal 2.7.18-13ubuntu1.5+esm6 Available with Ubuntu Pro python3.11 3.11.0~rc1-1~22.04.1~esm3 Available with Ubuntu Pro python3.11-minimal 3.11.0~rc1-1~22.04.1~esm3 Available with Ubuntu Pro Ubuntu 20.04 LTS python2.7 2.7.18-1~20.04.7+esm7 Available with Ubuntu Pro python2.7-minimal 2.7.18-1~20.04.7+esm7 Available with Ubuntu Pro python3.9 3.9.5-3ubuntu0~20.04.1+esm4 Available with Ubuntu Pro python3.9-minimal 3.9.5-3ubuntu0~20.04.1+esm4 Available with Ubuntu Pro Ubuntu 18.04 LTS python2.7 2.7.17-1~18.04ubuntu1.13+esm11 Available with Ubuntu Pro python2.7-minimal 2.7.17-1~18.04ubuntu1.13+esm11 Available with Ubuntu Pro python3.6 3.6.9-1~18.04ubuntu1.13+esm4 Available with Ubuntu Pro python3.6-minimal 3.6.9-1~18.04ubuntu1.13+esm4 Available with Ubuntu Pro python3.7 3.7.5-2ubuntu1~18.04.2+esm5 Available with Ubuntu Pro python3.7-minimal 3.7.5-2ubuntu1~18.04.2+esm5 Available with Ubuntu Pro python3.8 3.8.0-3ubuntu1~18.04.2+esm4 Available with Ubuntu Pro python3.8-minimal 3.8.0-3ubuntu1~18.04.2+esm4 Available with Ubuntu Pro Ubuntu 16.04 LTS python2.7 2.7.12-1ubuntu0~16.04.18+esm16 Available with Ubuntu Pro python2.7-minimal 2.7.12-1ubuntu0~16.04.18+esm16 Available with Ubuntu Pro Ubuntu 14.04 LTS python2.7 2.7.6-8ubuntu0.6+esm25 Available with Ubuntu Pro python2.7-minimal 2.7.6-8ubuntu0.6+esm25 Available with Ubuntu Pro python3.4 3.4.3-1ubuntu1~14.04.7+esm15 Available with Ubuntu Pro python3.4-minimal 3.4.3-1ubuntu1~14.04.7+esm15 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7280-2 https://ubuntu.com/security/notices/USN-7280-1 CVE-2025-0938 Package Information: https://launchpad.net/ubuntu/+source/python3.13/3.13.0-1ubuntu0.2 . A significant patch for Python targets SSRF vulnerabilities across various Ubuntu releases, reducing the chances of exploitation.. Python Security, Ubuntu Updates, SSRF Vulnerability, Python Releases. . Severity: Critical. LinuxSecurity.com Team
XMLTooling could be made to allow for unintended server side actions if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-6274-1 August 03, 2023 xmltooling vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: XMLTooling could be made to allow for unintended server side actions if it received specially crafted input. Software Description: - xmltooling: C++ XML parsing library with encryption support Details: Jurien de Jong discovered that XMLTooling did not properly handle certain KeyInfo element content within an XML signature. An attacker could possibly use this issue to achieve server-side request forgery. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS (Available with Ubuntu Pro): libxmltooling6v5 1.5.6-2ubuntu0.3+esm1 After a standard system update you need to restart the shibd process to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6274-1 CVE-2023-36661 . Unforeseen server behaviors linked to OpenSSL weakness outlined in Ubuntu Security Notice USN-6298-1 from September 2023.. XMLTooling Vulnerability, Ubuntu Updates, Security Advisory. . Severity: Critical. LinuxSecurity.com Team
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other . MGASA-2023-0126 - Updated python-cairosvg packages fix security vulnerability Publication date: 06 Apr 2023 URL: https://advisories.mageia.org/MGASA-2023-0126.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-27586 CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default. (CVE-2023-27586) References: - https://bugs.mageia.org/show_bug.cgi?id=31730 - https://lists.fedoraproject.org/archives/list/
Get the latest Linux and open source security news straight to your inbox.