Ubuntu alert USN-8586-1 (libgphoto2)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8586-1] libgphoto2 vulnerabilities
Date:
             
 
Wed, 22 Jul 2026 14:36:41 +0000
Message-ID:
             
 
<E1wmY3t-00023l-V0@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8586-1
July 22, 2026

libgphoto2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in libgphoto2.

Software Description:
- libgphoto2: gphoto2 digital camera library

Details:

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing EOS image format data. An attacker with physical
access could possibly use this issue to obtain sensitive information.
(CVE-2026-40333)

It was discovered that libgphoto2 did not properly null-terminate buffers
when parsing Canon folder entries. An attacker with physical access could
possibly use this issue to obtain sensitive information. (CVE-2026-40334)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing device property values. An attacker with physical
access could possibly use this issue to obtain sensitive information.
(CVE-2026-40335)

It was discovered that libgphoto2 had a memory leak when parsing Sony
device property descriptors. An attacker with physical access could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 26.04 LTS. (CVE-2026-40336)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing Sony device property enumeration data. An attacker
with physical access could possibly use this issue to obtain sensitive
information. (CVE-2026-40338)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing Sony device property form flags. An attacker with
physical access could possibly use this issue to obtain sensitive
information. (CVE-2026-40339)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing object information. An attacker with physical
access could possibly use this issue to obtain sensitive information.
(CVE-2026-40340)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing EOS focus information. An attacker with physical
access could possibly use this issue to cause libgphoto2 to crash,
resulting in a denial of service. (CVE-2026-40341)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libgphoto2-6t64                 2.5.33-1ubuntu1.1

Ubuntu 24.04 LTS
  libgphoto2-6t64                 2.5.31-2.1ubuntu1.1

Ubuntu 22.04 LTS
  libgphoto2-6                    2.5.27-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8586-1
  CVE-2026-40333, CVE-2026-40334, CVE-2026-40335, CVE-2026-40336,
  CVE-2026-40338, CVE-2026-40339, CVE-2026-40340, CVE-2026-40341

Package Information:
  https://launchpad.net/ubuntu/+source/libgphoto2/2.5.33-1u...
  https://launchpad.net/ubuntu/+source/libgphoto2/2.5.31-2....
  https://launchpad.net/ubuntu/+source/libgphoto2/2.5.27-1u...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpg1AcACgkQcpJm3tlz
hgHJTw//UD0ou8aiNWPR8JH3qLGqz6xCkdzg9b5JXdSoodvrbZQyLGtvBdO6NLAr
9gsCzScBI9O9Wqj0/h7UtPiMwlh3ka23K1DCcTsxUR9b3lc5wkoR6Cdei5hxO+EQ
6EiPUfJANnqwDP3UFqVQYuU7qKxW2eNxCNnpLikF0KmuGiFNsPLvlKtgEWgW7n7e
/9HgenVyOGvOz1tQ7EYLLUedARXiDJR2uzNZwrmXeq6KVhBUTdM7Io1vjjsXUoyV
SNZACohGYRDW55UNoGC7LwVkKpbmKgtJeFyFZ7JgLx6nzHC/VqgnOqY5mxrZL0g3
/Zk0PqrsWnl4f4frtqaw6L9hje4x25msZ/soBuqqoWoHziqAk1qpwoNunSAztl4V
Bqvqo3OjRUNmeymBeFUxU3fHPuptw0dWCNDOs7AMe9qb6gpbxlz7oHQALgU8ovxa
stHbbt6YCm+p6sIBPyI78sKUjGSiGPOxDGp/jVR7+YWOMXqgQiG68qvxMB3Bzw6k
5vIuu4plqV62xcrIjm4OixjMFgQ8QrlSos9++59ibTcOhNAiamFDfuVJ40PastbL
lFylAIxH/JUPIEiOxSx5PLzfR6y66IG9+AeylHcuQNH+oM6zK85y4KyRqnqJ1iH5
o3oyC3ivDydYkjUgROKwv3Qw8t5yWac5OWDNezzdHt0yn8CZjjQ=
=VsV9
-----END PGP SIGNATURE-----