Ubuntu alert USN-8484-1 (libgd-perl)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8484-1] GD.pm vulnerability
Date:
             
 
Tue, 30 Jun 2026 15:08:03 +0000
Message-ID:
             
 
<E1wea4B-000325-Rm@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8484-1
June 30, 2026

libgd-perl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

GD.pm could be made to run programs or overwrite files if it opened a
specially crafted file.

Software Description:
- libgd-perl: Perl module wrapper for libgd

Details:

It was discovered that GD.pm incorrectly handled filename arguments. An
attacker could possibly use this issue to execute arbitrary commands or
overwrite files.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libgd-perl                      2.84-2ubuntu0.1

Ubuntu 25.10
  libgd-perl                      2.78-1ubuntu0.25.10.1

Ubuntu 24.04 LTS
  libgd-perl                      2.78-1ubuntu0.24.04.1

Ubuntu 22.04 LTS
  libgd-perl                      2.76-2ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8484-1
  CVE-2026-11526

Package Information:
  https://launchpad.net/ubuntu/+source/libgd-perl/2.84-2ubu...
  https://launchpad.net/ubuntu/+source/libgd-perl/2.78-1ubu...
  https://launchpad.net/ubuntu/+source/libgd-perl/2.78-1ubu...
  https://launchpad.net/ubuntu/+source/libgd-perl/2.76-2ubu...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpDvTUACgkQcpJm3tlz
hgE7rw/+KTx7O/4QmzQa1RVXNJWatM2OzMUaeieqTNw/PrIrd8gHs0zU1pWlM8j8
G/eavnDbXiQGc2c2s29BV+P81owui5ePyCVw03t9xIxEZ66+zJ0qld5EDWNg9WhN
rhsTCY3PRQZPI/PgdXCRk4SmYbDlaHdiAVgL++TKLQqdw886oI/XgYcfLIB7rkVQ
uKbAS1LoZAybQYdf4hMxW9XWQ+sD/PjQDkIBBshKyPaN2lYPx1yIHxGLfzxEwsoD
6DpvI4Pw840bXPActYDtGK7kMSmjZ4H1Svc+JaXlAp87VOlMCPy1pTzjo1uhP0wn
01z2hoe/5Ji1axfwbi3Z1+Dz0iSH/LsvuVY0WJ8D3vYaib5l0Blw/RxBcZoNSCAK
17emczLU8svzJ/4pYE/VNvjibdlPG+VOxfzGSPFQg4UuLa/oPUlQPbqdxhg4lrhZ
SRZZ/eTKnTQHSQ8Kwfebq2+sLJ5qivcPVu7j3xZdhb4jvpfTSJmTlR2JhdHab6dl
joksUL6ZozOw6xKFsCUbFMpqFBW8YuQGGGzPAPN3x1tqJkBLnusRpnVX1EJHgrc8
hzJPvu//OmvOC7zPea+qq4dShVZ3tHkvgViMhED7o2a9tMPZluaPSqZ6tz8Aun/Y
fQo4yBPfFYXPO3bawPhbiSKTTdKOBqmeITTf8y28JKwV7kvoDvs=
=i/cw
-----END PGP SIGNATURE-----