{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "libgssapi-krb5-2",
                "libk5crypto3",
                "libkrb5-3",
                "libkrb5support0",
                "tar"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "libgssapi-krb5-2",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.6",
                    "version": "1.20.1-6ubuntu2.6"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.7",
                    "version": "1.20.1-6ubuntu2.7"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11850",
                        "url": "https://ubuntu.com/security/CVE-2026-11850",
                        "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-11 10:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-4035",
                        "url": "https://ubuntu.com/security/CVE-2026-4035",
                        "cve_description": "",
                        "cve_priority": "n/a",
                        "cve_public_date": ""
                    },
                    {
                        "cve": "CVE-2026-40355",
                        "url": "https://ubuntu.com/security/CVE-2026-40355",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 06:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-40356",
                        "url": "https://ubuntu.com/security/CVE-2026-40356",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11850",
                                "url": "https://ubuntu.com/security/CVE-2026-11850",
                                "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-11 10:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-4035",
                                "url": "https://ubuntu.com/security/CVE-2026-4035",
                                "cve_description": "",
                                "cve_priority": "n/a",
                                "cve_public_date": ""
                            },
                            {
                                "cve": "CVE-2026-40355",
                                "url": "https://ubuntu.com/security/CVE-2026-40355",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 06:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-40356",
                                "url": "https://ubuntu.com/security/CVE-2026-40356",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: nteger underflow berval2tl_data()",
                            "    - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap",
                            "      in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.",
                            "    - CVE-2026-11850",
                            "  * SECURITY UPDATE: security issues in the NegoEx mechanism",
                            "    - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing",
                            "      vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.",
                            "    - CVE-2026-40355",
                            "    - CVE-2026-40356",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.20.1-6ubuntu2.7",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Wed, 15 Jul 2026 14:25:57 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libk5crypto3",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.6",
                    "version": "1.20.1-6ubuntu2.6"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.7",
                    "version": "1.20.1-6ubuntu2.7"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11850",
                        "url": "https://ubuntu.com/security/CVE-2026-11850",
                        "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-11 10:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-4035",
                        "url": "https://ubuntu.com/security/CVE-2026-4035",
                        "cve_description": "",
                        "cve_priority": "n/a",
                        "cve_public_date": ""
                    },
                    {
                        "cve": "CVE-2026-40355",
                        "url": "https://ubuntu.com/security/CVE-2026-40355",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 06:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-40356",
                        "url": "https://ubuntu.com/security/CVE-2026-40356",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11850",
                                "url": "https://ubuntu.com/security/CVE-2026-11850",
                                "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-11 10:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-4035",
                                "url": "https://ubuntu.com/security/CVE-2026-4035",
                                "cve_description": "",
                                "cve_priority": "n/a",
                                "cve_public_date": ""
                            },
                            {
                                "cve": "CVE-2026-40355",
                                "url": "https://ubuntu.com/security/CVE-2026-40355",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 06:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-40356",
                                "url": "https://ubuntu.com/security/CVE-2026-40356",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: nteger underflow berval2tl_data()",
                            "    - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap",
                            "      in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.",
                            "    - CVE-2026-11850",
                            "  * SECURITY UPDATE: security issues in the NegoEx mechanism",
                            "    - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing",
                            "      vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.",
                            "    - CVE-2026-40355",
                            "    - CVE-2026-40356",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.20.1-6ubuntu2.7",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Wed, 15 Jul 2026 14:25:57 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libkrb5-3",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.6",
                    "version": "1.20.1-6ubuntu2.6"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.7",
                    "version": "1.20.1-6ubuntu2.7"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11850",
                        "url": "https://ubuntu.com/security/CVE-2026-11850",
                        "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-11 10:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-4035",
                        "url": "https://ubuntu.com/security/CVE-2026-4035",
                        "cve_description": "",
                        "cve_priority": "n/a",
                        "cve_public_date": ""
                    },
                    {
                        "cve": "CVE-2026-40355",
                        "url": "https://ubuntu.com/security/CVE-2026-40355",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 06:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-40356",
                        "url": "https://ubuntu.com/security/CVE-2026-40356",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11850",
                                "url": "https://ubuntu.com/security/CVE-2026-11850",
                                "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-11 10:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-4035",
                                "url": "https://ubuntu.com/security/CVE-2026-4035",
                                "cve_description": "",
                                "cve_priority": "n/a",
                                "cve_public_date": ""
                            },
                            {
                                "cve": "CVE-2026-40355",
                                "url": "https://ubuntu.com/security/CVE-2026-40355",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 06:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-40356",
                                "url": "https://ubuntu.com/security/CVE-2026-40356",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: nteger underflow berval2tl_data()",
                            "    - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap",
                            "      in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.",
                            "    - CVE-2026-11850",
                            "  * SECURITY UPDATE: security issues in the NegoEx mechanism",
                            "    - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing",
                            "      vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.",
                            "    - CVE-2026-40355",
                            "    - CVE-2026-40356",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.20.1-6ubuntu2.7",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Wed, 15 Jul 2026 14:25:57 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libkrb5support0",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.6",
                    "version": "1.20.1-6ubuntu2.6"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.20.1-6ubuntu2.7",
                    "version": "1.20.1-6ubuntu2.7"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11850",
                        "url": "https://ubuntu.com/security/CVE-2026-11850",
                        "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-11 10:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-4035",
                        "url": "https://ubuntu.com/security/CVE-2026-4035",
                        "cve_description": "",
                        "cve_priority": "n/a",
                        "cve_public_date": ""
                    },
                    {
                        "cve": "CVE-2026-40355",
                        "url": "https://ubuntu.com/security/CVE-2026-40355",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 06:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-40356",
                        "url": "https://ubuntu.com/security/CVE-2026-40356",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-28 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11850",
                                "url": "https://ubuntu.com/security/CVE-2026-11850",
                                "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-11 10:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-4035",
                                "url": "https://ubuntu.com/security/CVE-2026-4035",
                                "cve_description": "",
                                "cve_priority": "n/a",
                                "cve_public_date": ""
                            },
                            {
                                "cve": "CVE-2026-40355",
                                "url": "https://ubuntu.com/security/CVE-2026-40355",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 06:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-40356",
                                "url": "https://ubuntu.com/security/CVE-2026-40356",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-28 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: nteger underflow berval2tl_data()",
                            "    - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap",
                            "      in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.",
                            "    - CVE-2026-11850",
                            "  * SECURITY UPDATE: security issues in the NegoEx mechanism",
                            "    - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing",
                            "      vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.",
                            "    - CVE-2026-40355",
                            "    - CVE-2026-40356",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.20.1-6ubuntu2.7",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Wed, 15 Jul 2026 14:25:57 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "tar",
                "from_version": {
                    "source_package_name": "tar",
                    "source_package_version": "1.35+dfsg-3ubuntu0.3",
                    "version": "1.35+dfsg-3ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "tar",
                    "source_package_version": "1.35+dfsg-3ubuntu0.4",
                    "version": "1.35+dfsg-3ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-5704",
                        "url": "https://ubuntu.com/security/CVE-2026-5704",
                        "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-04-06 16:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2161311
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-5704",
                                "url": "https://ubuntu.com/security/CVE-2026-5704",
                                "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-04-06 16:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Old archives with nonzero directory sizes",
                            "    failing to be extracted",
                            "    - debian/patches/CVE-2026-5704-5.patch: fix this by forcing",
                            "      the size to zero for DIRTYPE in read_header() in src/list.c",
                            "      (LP: #2161311).",
                            ""
                        ],
                        "package": "tar",
                        "version": "1.35+dfsg-3ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [
                            2161311
                        ],
                        "author": "Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>",
                        "date": "Mon, 20 Jul 2026 11:38:13 -0300"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 24.04 noble image from daily image serial 20260722 to 20260723",
    "from_series": "noble",
    "to_series": "noble",
    "from_serial": "20260722",
    "to_serial": "20260723",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}