Public bug reported:
Ubuntu 16.04 Xenial
Ubuntu Pro attached
Subscription: Ubuntu Pro - free personal subscription
Services enabled:
- esm-apps
- esm-infra
Issue:
Ubuntu security tracker indicates that CVE-2026-109618 and
CVE-2026-109619 are fixed in:
7.0.33-0ubuntu0.16.04.16+esm22
However the server only receives:
7.0.33-0ubuntu0.16.04.16+esm18
Evidence:
pro fix CVE-2026-109618
returns:
"A fix is available in Ubuntu Pro: ESM Infra"
and attempts to install:
php7.0-cli
php7.0-common
libapache2-mod-php7.0
version:
7.0.33-0ubuntu0.16.04.16+esm22
but reports:
"CVE-2026-109618 is not resolved"
At the same time:
apt-cache madison php7.0-common
shows only:
7.0.33-0ubuntu0.16.04.16+esm18
Additional verification:
grep -R "7.0.33-0ubuntu0.16.04.16+esm22" /var/lib/apt/lists/
returns no results.
Question:
Why does Ubuntu Pro require php7.0 version
7.0.33-0ubuntu0.16.04.16+esm22 while ESM repositories only publish
+esm18?
** Affects: php7.0 (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172239
Title:
Ubuntu Pro reports php7.0 7.0.33-0ubuntu0.16.04.16+esm22 for
CVE-2026-109618 but ESM repositories only expose +esm18
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php7.0/+bug/2172239/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
