[ubuntu/resolute-security] jq 1.8.1-4ubuntu2 (Accepted)

[Bruce Cable]

jq (1.8.1-4ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow
    - debian/patches/CVE-2026-32316.patch: Fix heap buffer overflow in
      `jvp_string_append` and `jvp_string_copy_replace_bad`
    - CVE-2026-32316
  * SECURITY UPDATE: Stack Buffer Overflow
    - debian/patches/CVE-2026-33947.patch: Limit path depth to prevent
      stack overflow
    - CVE-2026-33947
  * SECURITY UPDATE: Improper Null Termination
    - debian/patches/CVE-2026-33948.patch: Fix NUL truncation in the
      JSON parser
    - CVE-2026-33948
  * SECURITY UPDATE: Out of Bounds Read
    - debian/patches/CVE-2026-39956.patch: Add runtime type checks to
      f_string_indexes
    - debian/patches/CVE-2026-39979.patch: Fix out-of-bounds read in
      jv_parse_sized()
    - CVE-2026-39956
    - CVE-2026-39979
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-40164.patch: Randomize hash seed to
      mitigate hash collision DoS attacks
    - CVE-2026-40164

Date: 2026-04-21 03:20:09.770460+00:00
Changed-By: Bruce Cable <bruce.cable at canonical.com>
https://launchpad.net/ubuntu/+source/jq/1.8.1-4ubuntu2
-------------- next part --------------
Sorry, changesfile not available.