Ubuntu alert USN-8485-1 (libyang)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8485-1] libyang vulnerability
Date:
             
 
Tue, 30 Jun 2026 15:08:15 +0000
Message-ID:
             
 
<E1wea4N-00037d-1n@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8485-1
June 30, 2026

libyang vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10

Summary:

libyang could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
- libyang: parser toolkit for IETF YANG data modeling

Details:

It was discovered that libyang incorrectly handled certain metadata list
pointers. An attacker could use this issue to cause libyang to crash,
resulting in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libyang3                        3.13.6-1ubuntu0.1

Ubuntu 25.10
  libyang3                        3.13.5-2ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8485-1
  CVE-2026-41401

Package Information:
  https://launchpad.net/ubuntu/+source/libyang/3.13.6-1ubun...
  https://launchpad.net/ubuntu/+source/libyang/3.13.5-2ubun...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpDvboACgkQcpJm3tlz
hgFqfRAAv/GMhX8yszFfTs4JeGijGwtdqTaJRH7WYx+EvyFrEh4OkfaGYzqaGoYb
xe3YcJrdWF6ujKJPzIClUMRp43lgoS5C/t3hXDRoxYzZh8jrHyl97rg0+coB706R
Qg1qlUcMFdkD9OUEv7pe1zSd1p8fzb4f/YMHLnrUxAG+aB/lB0DHEvHsUsuiP/HL
9zoqwl5uVy7Zq5vlElp5vsEflthmx/2tyEX+lU/Ip/DwOV+iqkxrPgd0mY6HQWuw
CSc9uYF19CY/wBQjhqRCH9EqF5T5R66zC8v5XzXTYhtYSGxYh3sYaTatqoF0nx2r
mI12bnzuR0mHV8jJNjOsody33ctSBT3peLTb8wL0aDBYhdLQRi38kSb6QFB2HpPo
THQ2NvPJ0we73kC8V1+uItx5nbW/le5ZRUGZ7siLJYEd/By3QjrglIEJ1U2nAZhI
Oe7fm7f5oP27+c0JMyhYt4+KhAzv/QTR9d81j4x9jZaE3xsjKGjdulGXpoVg8yhU
Wigp6pH5sBNlWPTCp9TEp6q7JOTQ1yVSE2XFdr+ReLxHsJ6oqswBWy/mys2TdX4c
0WDS26VfzlUZ5VZy4ODwR2vSThMTK8lZcU/mtd21MzAKzI6lyI3VU8mSRviZ+yCz
aPcGeF+ReN+vDTc0CvjZof6a7C48WFLiRc502AQziWbqG4QImdI=
=uDQA
-----END PGP SIGNATURE-----