Further investigation indicates that this is not a php7.0 packaging
issue.
The affected system is running Ubuntu 16.04 LTS (Xenial) with Ubuntu Pro
Free. The currently available PHP package is
7.0.33-0ubuntu0.16.04.16+esm18, while the security fixes for
CVE-2026-109618 and CVE-2026-109619 require +esm22.
We have determined that access to the required packages is related to
Ubuntu Pro / Legacy support entitlement for Ubuntu 16.04, rather than an
issue with the php7.0 package itself.
We are therefore pursuing this matter with Canonical through the
appropriate Ubuntu Pro commercial/support channel.
I am closing this bug as Invalid. Thank you.
** Changed in: php7.0 (Ubuntu)
Status: New => Invalid
** CVE added: https://cve.org/CVERecord?id=CVE-2026-109618
** CVE added: https://cve.org/CVERecord?id=CVE-2026-109619
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172239
Title:
Ubuntu Pro reports php7.0 7.0.33-0ubuntu0.16.04.16+esm22 for
CVE-2026-109618 but ESM repositories only expose +esm18
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php7.0/+bug/2172239/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
