{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "curl",
                "libcurl3-gnutls:riscv64",
                "libcurl4:riscv64",
                "libgssapi-krb5-2:riscv64",
                "libk5crypto3:riscv64",
                "libkrb5-3:riscv64",
                "libkrb5support0:riscv64",
                "snapd"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "curl",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.16",
                    "version": "7.81.0-1ubuntu1.16"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.17",
                    "version": "7.81.0-1ubuntu1.17"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-7264",
                        "url": "https://ubuntu.com/security/CVE-2024-7264",
                        "cve_description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.  This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-07-31 08:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-7264",
                                "url": "https://ubuntu.com/security/CVE-2024-7264",
                                "cve_description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.  This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-07-31 08:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: ASN.1 date parser overread",
                            "    - debian/patches/CVE-2024-7264-pre1.patch: clean up GTime2str in",
                            "      lib/x509asn1.c.",
                            "    - debian/patches/CVE-2024-7264.patch: unittests and fixes for gtime2str",
                            "      in lib/x509asn1.c, lib/x509asn1.h, tests/data/Makefile.inc,",
                            "      tests/data/test1656, tests/unit/Makefile.inc, tests/unit/unit1656.c.",
                            "    - CVE-2024-7264",
                            ""
                        ],
                        "package": "curl",
                        "version": "7.81.0-1ubuntu1.17",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 01 Aug 2024 09:51:30 -0400"
                    }
                ],
                "notes": null
            },
            {
                "name": "libcurl3-gnutls:riscv64",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.16",
                    "version": "7.81.0-1ubuntu1.16"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.17",
                    "version": "7.81.0-1ubuntu1.17"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-7264",
                        "url": "https://ubuntu.com/security/CVE-2024-7264",
                        "cve_description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.  This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-07-31 08:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-7264",
                                "url": "https://ubuntu.com/security/CVE-2024-7264",
                                "cve_description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.  This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-07-31 08:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: ASN.1 date parser overread",
                            "    - debian/patches/CVE-2024-7264-pre1.patch: clean up GTime2str in",
                            "      lib/x509asn1.c.",
                            "    - debian/patches/CVE-2024-7264.patch: unittests and fixes for gtime2str",
                            "      in lib/x509asn1.c, lib/x509asn1.h, tests/data/Makefile.inc,",
                            "      tests/data/test1656, tests/unit/Makefile.inc, tests/unit/unit1656.c.",
                            "    - CVE-2024-7264",
                            ""
                        ],
                        "package": "curl",
                        "version": "7.81.0-1ubuntu1.17",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 01 Aug 2024 09:51:30 -0400"
                    }
                ],
                "notes": null
            },
            {
                "name": "libcurl4:riscv64",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.16",
                    "version": "7.81.0-1ubuntu1.16"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.17",
                    "version": "7.81.0-1ubuntu1.17"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-7264",
                        "url": "https://ubuntu.com/security/CVE-2024-7264",
                        "cve_description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.  This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-07-31 08:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-7264",
                                "url": "https://ubuntu.com/security/CVE-2024-7264",
                                "cve_description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.  This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-07-31 08:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: ASN.1 date parser overread",
                            "    - debian/patches/CVE-2024-7264-pre1.patch: clean up GTime2str in",
                            "      lib/x509asn1.c.",
                            "    - debian/patches/CVE-2024-7264.patch: unittests and fixes for gtime2str",
                            "      in lib/x509asn1.c, lib/x509asn1.h, tests/data/Makefile.inc,",
                            "      tests/data/test1656, tests/unit/Makefile.inc, tests/unit/unit1656.c.",
                            "    - CVE-2024-7264",
                            ""
                        ],
                        "package": "curl",
                        "version": "7.81.0-1ubuntu1.17",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 01 Aug 2024 09:51:30 -0400"
                    }
                ],
                "notes": null
            },
            {
                "name": "libgssapi-krb5-2:riscv64",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.3",
                    "version": "1.19.2-2ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.4",
                    "version": "1.19.2-2ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-37370",
                        "url": "https://ubuntu.com/security/CVE-2024-37370",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2024-37371",
                        "url": "https://ubuntu.com/security/CVE-2024-37371",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 23:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-37370",
                                "url": "https://ubuntu.com/security/CVE-2024-37370",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2024-37371",
                                "url": "https://ubuntu.com/security/CVE-2024-37371",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 23:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Invalid token requests",
                            "    - debian/patches/CVE-2024-37370.patch: Fix vulnerabilities in GSS",
                            "    message token handling",
                            "    - CVE-2024-37370",
                            "    - CVE-2024-37371",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.19.2-2ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Bruce Cable <bruce.cable@canonical.com>",
                        "date": "Mon, 15 Jul 2024 13:46:10 +1000"
                    }
                ],
                "notes": null
            },
            {
                "name": "libk5crypto3:riscv64",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.3",
                    "version": "1.19.2-2ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.4",
                    "version": "1.19.2-2ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-37370",
                        "url": "https://ubuntu.com/security/CVE-2024-37370",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2024-37371",
                        "url": "https://ubuntu.com/security/CVE-2024-37371",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 23:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-37370",
                                "url": "https://ubuntu.com/security/CVE-2024-37370",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2024-37371",
                                "url": "https://ubuntu.com/security/CVE-2024-37371",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 23:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Invalid token requests",
                            "    - debian/patches/CVE-2024-37370.patch: Fix vulnerabilities in GSS",
                            "    message token handling",
                            "    - CVE-2024-37370",
                            "    - CVE-2024-37371",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.19.2-2ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Bruce Cable <bruce.cable@canonical.com>",
                        "date": "Mon, 15 Jul 2024 13:46:10 +1000"
                    }
                ],
                "notes": null
            },
            {
                "name": "libkrb5-3:riscv64",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.3",
                    "version": "1.19.2-2ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.4",
                    "version": "1.19.2-2ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-37370",
                        "url": "https://ubuntu.com/security/CVE-2024-37370",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2024-37371",
                        "url": "https://ubuntu.com/security/CVE-2024-37371",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 23:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-37370",
                                "url": "https://ubuntu.com/security/CVE-2024-37370",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2024-37371",
                                "url": "https://ubuntu.com/security/CVE-2024-37371",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 23:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Invalid token requests",
                            "    - debian/patches/CVE-2024-37370.patch: Fix vulnerabilities in GSS",
                            "    message token handling",
                            "    - CVE-2024-37370",
                            "    - CVE-2024-37371",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.19.2-2ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Bruce Cable <bruce.cable@canonical.com>",
                        "date": "Mon, 15 Jul 2024 13:46:10 +1000"
                    }
                ],
                "notes": null
            },
            {
                "name": "libkrb5support0:riscv64",
                "from_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.3",
                    "version": "1.19.2-2ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "krb5",
                    "source_package_version": "1.19.2-2ubuntu0.4",
                    "version": "1.19.2-2ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-37370",
                        "url": "https://ubuntu.com/security/CVE-2024-37370",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2024-37371",
                        "url": "https://ubuntu.com/security/CVE-2024-37371",
                        "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-06-28 23:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-37370",
                                "url": "https://ubuntu.com/security/CVE-2024-37370",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2024-37371",
                                "url": "https://ubuntu.com/security/CVE-2024-37371",
                                "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-06-28 23:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Invalid token requests",
                            "    - debian/patches/CVE-2024-37370.patch: Fix vulnerabilities in GSS",
                            "    message token handling",
                            "    - CVE-2024-37370",
                            "    - CVE-2024-37371",
                            ""
                        ],
                        "package": "krb5",
                        "version": "1.19.2-2ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Bruce Cable <bruce.cable@canonical.com>",
                        "date": "Mon, 15 Jul 2024 13:46:10 +1000"
                    }
                ],
                "notes": null
            },
            {
                "name": "snapd",
                "from_version": {
                    "source_package_name": "snapd",
                    "source_package_version": "2.63+22.04",
                    "version": "2.63+22.04"
                },
                "to_version": {
                    "source_package_name": "snapd",
                    "source_package_version": "2.63+22.04ubuntu0.1",
                    "version": "2.63+22.04ubuntu0.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-1724",
                        "url": "https://ubuntu.com/security/CVE-2024-1724",
                        "cve_description": "In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-07-25 19:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2024-29068",
                        "url": "https://ubuntu.com/security/CVE-2024-29068",
                        "cve_description": "In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-07-25 20:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2024-29069",
                        "url": "https://ubuntu.com/security/CVE-2024-29069",
                        "cve_description": "In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.",
                        "cve_priority": "medium",
                        "cve_public_date": "2024-07-25 20:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-1724",
                                "url": "https://ubuntu.com/security/CVE-2024-1724",
                                "cve_description": "In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-07-25 19:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2024-29068",
                                "url": "https://ubuntu.com/security/CVE-2024-29068",
                                "cve_description": "In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-07-25 20:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2024-29069",
                                "url": "https://ubuntu.com/security/CVE-2024-29069",
                                "cve_description": "In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.",
                                "cve_priority": "medium",
                                "cve_public_date": "2024-07-25 20:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sandbox escape via $HOME/bin",
                            "    - interfaces/builtin/home: explicitly deny writing to @{HOME}/bin",
                            "    - CVE-2024-1724",
                            "  * SECURITY UPDATE: denial-of-service via crafted files in squashfs image",
                            "    - snap, snapdir, squashfs: improve validation of target file",
                            "      mode/types",
                            "    - CVE-2024-29068",
                            "  * SECURITY UPDATE: information disclosure via crafted symlinks in",
                            "    squashfs image",
                            "    - snap, snapdir, squashfs: improve external symlink validation",
                            "    - CVE-2024-29069",
                            "  * Fix FTBFS due to missing systemd from Build-Depends",
                            "    - debian/control: add systemd to Build-Depends to ensure pkg-config",
                            "      can find the systemdutildir to install into",
                            ""
                        ],
                        "package": "snapd",
                        "version": "2.63+22.04ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Alex Murray <alex.murray@canonical.com>",
                        "date": "Fri, 26 Jul 2024 12:27:32 +0930"
                    }
                ],
                "notes": null
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20240801 to 20240808",
    "from_series": "jammy",
    "to_series": "jammy",
    "from_serial": "20240801",
    "to_serial": "20240808",
    "from_manifest_filename": "release_manifest.previous",
    "to_manifest_filename": "manifest.current"
}