News
ai OpenCode breach exposes stored OpenAI and Anthropic keys, prompts urgent key rotation - Startup Fortune - Anthropic - Claude AI cybersecurity Microsoft 365: let an app send mail from chosen mailboxes only - Pro CISO cybersecurity Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack - BleepingComputer cybersecurity Drupal patches critical RCE flaws, warns exploits may emerge soon - BleepingComputer threat-intel Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups - GBHackers cybersecurity ConnectWise SkyKick Credentials Abused in Microsoft 365 Attacks, Backup Services Shut Down - CyberPress cybersecurity Encryption Is Getting Squeezed From All Sides - Wired Security cybersecurity MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon - The Hacker News cybersecurity Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel - SecurityWeek threat-intel Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years - GBHackers threat-intel Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication - GBHackers threat-intel OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root - GBHackers threat-intel GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories - GBHackers threat-intel SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data - GBHackers cybersecurity Anthropic’s Claude AI Solves 25-Year-Old NSA Cryptography Mystery in Under 30 Minutes - CyberPress
1 / 15
All news ›
Vulnerability

USN-8930-1: U-Boot vulnerabilities

Ubuntu Security Notices ·

Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not properly validate certain DHCPv6 option lengths during network boot. An attacker could possibly use this issue to trigger out-of-bounds memory access, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74225)

Continue on Ubuntu Security Notices ↗ ‹ All news Get the newsletter