Ubuntu alert USN-8256-1 (opam)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8256-1] opam vulnerability
Date:
             
 
Thu, 07 May 2026 16:50:13 +0000
Message-ID:
             
 
<E1wL1vR-0003pa-Fk@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8256-1
May 07, 2026

opam vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

opam could be made to install files in unintended locations if it installed
a specially crafted package.

Software Description:
- opam: package manager for OCaml

Details:

Andrew Nesbitt discovered that opam did not properly validate file
destination paths in package install files. An attacker could use this
issue to bypass sandbox protections and write files to arbitrary locations,
possibly leading to arbitrary code execution.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  opam                            2.5.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  opam-installer                  2.5.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 25.10
  opam                            2.3.0-1+deb13u1build0.25.10.1
  opam-installer                  2.3.0-1+deb13u1build0.25.10.1

Ubuntu 24.04 LTS
  opam                            2.1.5-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro
  opam-installer                  2.1.5-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  opam                            2.1.2-1+deb12u1build0.22.04.1
  opam-installer                  2.1.2-1+deb12u1build0.22.04.1

Ubuntu 20.04 LTS
  opam                            2.0.5-1ubuntu1+esm1
                                  Available with Ubuntu Pro
  opam-installer                  2.0.5-1ubuntu1+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8256-1
  CVE-2026-41082

Package Information:
  https://launchpad.net/ubuntu/+source/opam/2.3.0-1+deb13u1...
  https://launchpad.net/ubuntu/+source/opam/2.1.2-1+deb12u1...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmn8wmsACgkQcpJm3tlz
hgHqeQ//WSaGPgmyoSUl7d87sx8UW2o3n34HacJVZiAq6rq70pL7t/lpaeRfPHb/
m319tZNPPnWsx0EJbTelUsopRPFuxjYDiQufIZPGZDtyMYQwRhvo70GxcbVcNar3
WAr4uQOw00Ig5RU4Q1NkXn4aiZDlEfzmVe6glwGALiQFXcUzKQ2EsP1VDczgsqxu
aFPd+ieoIiJ5LGWMNqusonXes7TBk3vOiLlD6onCGayjebnUktt3gnJhVCyOv9em
rDVJgh9JE5g5dH5ABWz8wKWzfG1Jeq5JPeagkjzYQ3ot8r//41bmdGTz4YN3GoZb
jX95DGC4f2DT3yC0QXwNmcQU550XtbVsODW8Nt1daowdomttZlQKQ2D9tQUDGQe8
xCEKUbM7dWtk4B1NlmDTw6usslUUZ6bLddro/N/KH7Jgg9om5io2EQ3hVYCVwgLb
pF2E5WDeG6ADCdMAz0eJdX6a+LaETwxs1otFNKyZDD/P0Hna6k5mAmclIzfBhGMU
SyEb0643rT72yWGOi0R76cv7ob15opRD81kvXuR132PzSNYUjBC5xtO5HmFHCoM2
CjU3trKnrDV7YsSlCunamewvOzswOcBP+hB4ka+m7BmM8nuGIuEQtijRCXODADau
OLWsxY4clLkXeVRDynCAnOKdH1asFMteZFyqOaOm6pKZGHxBBes=
=B+rp
-----END PGP SIGNATURE-----