Canonical has released several security updates for Ubuntu, addressing flaws in fetchmail, Go cryptography libraries, and Linux kernels used in Oracle Cloud and AWS environments. These patches, issued between October 23 and 24, 2025, fix issues that could lead to denial-of-service attacks, unauthorized access, and information leaks. The updates target critical components to enhance system stability and security.
On October 23 and 24, 2025, Canonical published four Ubuntu Security Notices (USNs) to mitigate vulnerabilities in essential software components. USN-7838-1 corrects a flaw in the fetchmail SMTP client, where improper handling of specific status code messages could allow a malicious server to crash the service, causing a denial of service. Updated packages now prevent such remote-induced crashes.
USN-7839-1 fixes an issue in the Go Cryptography library (golang-go.crypto), identified by researchers Damien Tournoud, Patrick Dawkins, Vince Parker, and Jules Duvivier. The vulnerability involves incorrect handling of public keys during SSH operations, potentially enabling attackers to bypass authorization and gain unauthorized access to network services.
For cloud environments, USN-7795-4 updates the Linux kernel for Oracle Cloud systems (linux-oracle-5.4), resolving vulnerabilities in subsystems like Ext4, NFS server daemon, packet sockets, network traffic control, and the VMware vSockets driver. These flaws could compromise system integrity if exploited.
USN-7833-3 targets the Linux kernel for AWS systems (linux-aws-6.14), addressing side-channel vulnerabilities (CVE-2024-36350 and CVE-2024-36357) affecting certain AMD processors, discovered by Oleksii Oleksenko and Cedric Fournet. These could leak privileged information from prior stores.
The updates also include fixes across architectures such as ARM64, RISC-V, and x86, covering subsystems like USB, NVMe, networking, file systems (BTRFS, Ext4, NFS, Ceph, F2FS), and the BPF framework. Canonical urges all Ubuntu users and administrators to apply these updates immediately to maintain security.