Please use this debdiff instead of the previous one. I updated it to include the CVE numbers which were not available when I first prepared this upload.
** Patch added: "lomiri-download-manager_0.2.2-1ubuntu0.1.debdiff" https://bugs.launchpad.net/ubuntu/+source/lomiri-download-manager/+bug/2167356/+attachment/6003767/+files/lomiri-download-manager_0.2.2-1ubuntu0.1.debdiff ** Description changed: - lomiri-download-manager 0.3.3 includes 2 security fixes. A CVE has not been assigned yet. The security issues can be summarized as - - arbitrary root command execution - - unathenticated file access + lomiri-download-manager 0.3.3 includes 2 security fixes. + + The security issues can be summarized as + - arbitrary root command execution (CVE-2026-96425) + - unathenticated file access (CVE-2026-96424) Testing Done ------------ I successfully built lomiri-download-manager with the attached debdiff on Ubuntu 26.04 LTS and installed it onto Ubuntu 26.04 LTS running the Lomiri desktop. Once I had lomiri-upload-manager installed and then logged out and logged back in, I verified that I could use the poc.py from #18 to gain access to a file I shouldn't have. After installing the update and logging out and logging back in, I was unable to use poc.py to access that file. I verified the first command of the #17 proof of concept worked. After installing the update and logging out and logging back in, that proof of concept no longer worked. #17 has a second command that I wasn't able to get working. Other Info ---------- The original bug reports are here, but are not yet public: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/17 https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18 lomiri-upload-manager's only reverse dependency in Ubuntu is nuntium which itself has no reverse dependencies so it's unlikely for that component to be pre-installed. However the #17 proof of concept doesn't need lomiri-upload-manager. There is not yet an official or unofficial Ubuntu desktop flavor for Lomiri. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167356 Title: September 2026 security update To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lomiri-download-manager/+bug/2167356/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
