Back Linuxsecurity

Ubuntu 26.04 LTS Swish-e Critical Code Execution Threat USN-8240

Linuxsecurity •LinuxSecurity Advisories • May 7, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Swish-e. Software Description: - swish-e: Simple Web Indexing System for Humans - Enhanced Details: It was discovered that Expat, vendored in Swish-e incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-25235, CVE-2022-25236)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS swish-e 2.4.7-7.1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS swish-e 2.4.7-6.2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS swish-e 2.4.7-6.1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS swish-e 2.4.7-6ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS swish-e 2.4.7-5ubuntu1+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS swish-e 2.4.7-4ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2022-25235, CVE-2022-25236

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Code Execution Vulnerability in Swish-e Affects Multiple Ubuntu Releases A critical security vulnerability has been identified in Swish-e, affecting multiple versions of Ubuntu, including 26.04 LTS and earlier releases down to 16.04 LTS. The vulnerability, linked to Expat handling certain files, could allow attackers to execute arbitrary code or crash the application. This issue is tracked under CVE-2022-25235 and CVE-2022-25236, both published on 2022-02-16. Users are advised to update their systems to the latest package versions to mitigate the risk. The vulnerability impacts systems using Swish-e, a simple web indexing system. Ubuntu Pro users can access enhanced security coverage for these packages. A standard system update is recommended to address this issue. The advisory emphasizes the urgency of applying the patches to prevent potential exploitation. 4 sources 73

Extracted Entities

Ubuntu 26.04 LTS Swish-e Critical Code Execution Threat USN-8240

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)