Ubuntu alert USN-8040-1 (munge)
| From: | noreply+usn-bot@canonical.com | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8040-1] MUNGE vulnerability | |
| Date: | Thu, 12 Feb 2026 22:29:58 +0000 | |
| Message-ID: | <E1vqfCA-0008Mg-IK@lists.ubuntu.com> |
========================================================================== Ubuntu Security Notice USN-8040-1 February 12, 2026 munge vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: MUNGE could be made to crash or run programs as your login if it opened a specially crafted file. Software Description: - munge: authentication service for credentials Details: Titouan Lazard discovered that MUNGE contained an exploitable buffer overflow in munged (the MUNGE authentication daemon). A local attacker could possibly use this issue to forge MUNGE credentials, leading to arbitrary code execution. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 libmunge-dev 0.5.16-1ubuntu0.1 libmunge2 0.5.16-1ubuntu0.1 munge 0.5.16-1ubuntu0.1 Ubuntu 24.04 LTS libmunge-dev 0.5.15-4ubuntu0.1 libmunge2 0.5.15-4ubuntu0.1 munge 0.5.15-4ubuntu0.1 Ubuntu 22.04 LTS libmunge-dev 0.5.14-6ubuntu0.1 libmunge2 0.5.14-6ubuntu0.1 munge 0.5.14-6ubuntu0.1 Ubuntu 20.04 LTS libmunge-dev 0.5.13-2ubuntu0.1~esm1 Available with Ubuntu Pro libmunge2 0.5.13-2ubuntu0.1~esm1 Available with Ubuntu Pro munge 0.5.13-2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libmunge-dev 0.5.13-1ubuntu0.1~esm1 Available with Ubuntu Pro libmunge2 0.5.13-1ubuntu0.1~esm1 Available with Ubuntu Pro munge 0.5.13-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libmunge-dev 0.5.11-3ubuntu0.1+esm1 Available with Ubuntu Pro libmunge2 0.5.11-3ubuntu0.1+esm1 Available with Ubuntu Pro munge 0.5.11-3ubuntu0.1+esm1 Available with Ubuntu Pro Ubuntu 14.04 LTS libmunge-dev 0.5.11-1ubuntu1.1+esm1 Available with Ubuntu Pro libmunge2 0.5.11-1ubuntu1.1+esm1 Available with Ubuntu Pro munge 0.5.11-1ubuntu1.1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8040-1 CVE-2026-25506 Package Information: https://launchpad.net/ubuntu/+source/munge/0.5.16-1ubuntu0.1 https://launchpad.net/ubuntu/+source/munge/0.5.15-4ubuntu0.1 https://launchpad.net/ubuntu/+source/munge/0.5.14-6ubuntu0.1
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmmOVFIACgkQcpJm3tlz hgE6eBAAo6pGongkcMdMHoXGKFncVtZtmPSO0mFeghxU5/MoSk4g56hI5M0t7EQG 2I15Heczs8fBHRt8caH4rfcRsnLrLCvnOmtDiyhPKtk65lc4aKgTGtG/alhmwNQ1 qNQtkwBEi07isTx43QOOZDe9yY9FYFQqxUeGj+td+WyLfeogloqRMO3xUFzUX8B1 MzMEAbcPlhjOVznX0INrkAjAtterZFd5P7O+a583YP/ioWbYtFZ9/ESgJ42j1nG5 lXxwxP1BTX4NLM2908GSyEsCxVMsDYN9fiy0DFz2Tab6GyNpzKHDKKNliWZqIQxp 7+NI4kMWXTXvOxhyaLATrrviXyMelNb/lK+pHKFSCaKMcLYFG/QbCi5+V9HzGFPO 1lkw2WNxIH9xT+XgrrwgmXsaVk6xRk4gKBFIsKaU+wW2b+cChxyRhx/Ly6iSk7FZ cY/doFfeGToe7eEmy8j3nGIfAvYmNtx/7oTHi1IHAulNERSaLzhAHzPcAXdt0cPf nwsyQI8l03W5J5zSljBYJTZ4yiPd8u22Wn1W37EsCTHJCD3mua0cQpiqK4tVOuJW 0fglMhKUosHizikuWWiMVfjnQPURN6WYw4PoYAaNnFEI9gmnVAgH5d+njrDamscP CuICocaWSzpfPGcmiIz5fkrFFS5vLdgFF15cmsbJ+D47MGePhb4= =7nPG -----END PGP SIGNATURE-----