Ubuntu alert USN-8423-1 (lwip)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8423-1] lwIP vulnerabilities | |
| Date: | Thu, 11 Jun 2026 21:07:39 +0000 | |
| Message-ID: | <E1wXmcl-0005La-KF@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8423-1 June 11, 2026 lwip vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in lwIP. Software Description: - lwip: Lightweight TCP/IP stack Details: It was discovered that lwIP contained a buffer overflow in the EAP authentication handling code. An attacker could possibly use this issue to trigger a buffer overflow, resulting in arbitrary code execution or a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-8597) It was discovered that lwIP incorrectly handled certain ICMPv6 or 6LoWPAN packets. An attacker could possibly use this issue to trigger a buffer overflow, resulting in information disclosure. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-22283, CVE-2020-22284) It was discovered that lwIP did not properly validate certain SNMPv3 authentication parameters. An attacker could possibly use this issue to trigger a stack-based buffer overflow, resulting in arbitrary code execution or a denial of service. (CVE-2026-8836) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS liblwip-dev 2.2.1+dfsg1-4ubuntu0.1~esm1 Available with Ubuntu Pro liblwip-doc 2.2.1+dfsg1-4ubuntu0.1~esm1 Available with Ubuntu Pro liblwip0t64 2.2.1+dfsg1-4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS liblwip-dev 2.2.0+dfsg1-6.1ubuntu0.1~esm1 Available with Ubuntu Pro liblwip-doc 2.2.0+dfsg1-6.1ubuntu0.1~esm1 Available with Ubuntu Pro liblwip0t64 2.2.0+dfsg1-6.1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS liblwip-dev 2.1.3+dfsg1-1ubuntu0.1~esm1 Available with Ubuntu Pro liblwip-doc 2.1.3+dfsg1-1ubuntu0.1~esm1 Available with Ubuntu Pro liblwip0 2.1.3+dfsg1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS liblwip-dev 2.1.2+dfsg1-4ubuntu0.1~esm1 Available with Ubuntu Pro liblwip-doc 2.1.2+dfsg1-4ubuntu0.1~esm1 Available with Ubuntu Pro liblwip0 2.1.2+dfsg1-4ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8423-1 CVE-2020-22283, CVE-2020-22284, CVE-2020-8597, CVE-2026-8836
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmorI3AACgkQcpJm3tlz hgEJ/RAAy9kQvOf7unSTSIBjVPpECj1a8kzjECRUelpNKrIqYeHf6hDpZvfD9Egq JBsmSQEiTI8nSVnV8cr0lXPLpE+dEdooKA2npJv4lVAXFsrp95+lFKMn+zcdFl3o rJunHaDn9SGZDIeLP9GY+SYHjMEwExR8UjRlxZoq5Vat+qsWbIlKigCj8rhMB0ND tCM41kCeCSTeN9WZoYkpsBEsv7N13HO2foxeJe0/EQNLDzmqRV5evqv4BvsFEkG4 hcRVd/K6W1qfJIn7HNn3rYqbQjXYGjzne+6U1zkhBBuXbt17GcJa3b2MOnQovg9F NUaaGXU9K0+a/KASe8qg8OqsdItrV586p1gG+s4TWjwXG16rw255FaJug0zsT678 aXNkX7IhOfttxCortX1A6AUoUDmBC/PBW4tm6uwB4pWvOWSbkMvkfrvu3oDkVWwC TzeQoAMk60EBDDlG5+XNH4XKFe3uqDg3l4Vir1xjbMhE//TDmlr07g95f1jPFVPb 9Bj36zpor/EfqGnPWGUp9lIVEvvq07ZPIjm53jwPec+R+M15e/4uFnDh7wdIGn1a HhEEznQU/XJJPbwR7z9nXvSLXsMXZEb5+cxOXZODh8Ccsjb9TFMf6f5o9B/mlEMb ijWD7qgfO1dxg3HqrKj9apGI34XYXk6sEs96U2q5SW8eYjmiykE= =R2jg -----END PGP SIGNATURE-----