Ubuntu alert USN-8044-2 (alsa-lib)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8044-2] alsa-lib vulnerability
Date:
             
 
Tue, 09 Jun 2026 11:21:58 +0000
Message-ID:
             
 
<E1wWuWs-00084C-0w@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8044-2
June 09, 2026

alsa-lib vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

alsa-lib could be made to crash or run programs if it opened a specially
crafted file.

Software Description:
- alsa-lib: shared library for ALSA applications

Details:

USN-8044-1 fixed a vulnerability in alsa-lib. This update provides the
corresponding fix for alsa-lib on Ubuntu 20.04 LTS.

Original advisory details:

 It was discovered that alsa-lib incorrectly handled the topology mixer
 control decoder. A local attacker could use a specially crafted topology
 file to cause alsa-lib to crash, resulting in a denial of service, or
 possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  libasound2                      1.2.2-2.1ubuntu2.5+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8044-2
  https://ubuntu.com/security/notices/USN-8044-1
  CVE-2026-25068


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmon9j4ACgkQcpJm3tlz
hgF2Ug/+KbRY5rRcwBAn3LrIsB8+cQHczljFfB5Zu7xenysIa/WvVzDjaLf6JTev
ebmcz6EzOCpSYX0RKP2DHOlF9lMdFdZbxbtvi3i9gO7w5XBMkBjlXOw76u6qQ7hp
hx6YbwLoEV5+grV94WYP3QOKDBh/1m6gi255Sg8y1XQukMAbbbkCVChZP7X27pe7
88PoFGMDxO0Z/RafQa3tEProclOMiGeQNtPeBTEN2n05Ab39exzDaxhve4mH5f7g
7DTZCSPPUT3O7mTv3h9HwoUrQ6OoXtTlFk8nOju3UFDvyokAUJoJ+5g02/Q3CIT6
a4LB0/sKS9cT5xeA03CNlwJIiTdrCQTepovPu+ndxoRILj2GJ2ynTZiyCvG85KoS
NZEz07XNXJKZ9ZqdjrXzRuqWmMz7Q+RxsbmuLql4pP2EM0vSk3UtKv5/UY5FcsAK
+3IRUZBY6qyJOMleZwylQ1psg5O4pT9KlPLQcUe9L056AJkQF1xVRsLv7jUGIzJG
uf/Y+4MdOspA28GII7FcLXbUDpikxS7mhmNf+LXFoBEkSyyry8lP4BXL+WPy+4vk
VOG47vX+q7HqmefdvhWF0wVXRH3RAnOSxsPZT6w3Xu4WBgijf2S3WDVECISbGZQE
2zAtMERqzbsMIg3Ts4ikpVmce8OovpFtP0p1LOFaxJc14sF5iq4=
=EO/9
-----END PGP SIGNATURE-----