Back Ubuntu

USN-8235-1: ITK vulnerabilities

Ubuntu • May 7, 2026

It was discovered that Expat, vendored in ITK incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. ( CVE-2022-25235 , CVE-2022-25236 )

In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Code Execution Vulnerability in Swish-e Affects Multiple Ubuntu Releases A critical security vulnerability has been identified in Swish-e, affecting multiple versions of Ubuntu, including 26.04 LTS and earlier releases down to 16.04 LTS. The vulnerability, linked to Expat handling certain files, could allow attackers to execute arbitrary code or crash the application. This issue is tracked under CVE-2022-25235 and CVE-2022-25236, both published on 2022-02-16. Users are advised to update their systems to the latest package versions to mitigate the risk. The vulnerability impacts systems using Swish-e, a simple web indexing system. Ubuntu Pro users can access enhanced security coverage for these packages. A standard system update is recommended to address this issue. The advisory emphasizes the urgency of applying the patches to prevent potential exploitation. 4 sources 73

Extracted Entities

CVEs (2)

CVE-2022-25235 CVE-2022-25236

Platforms (1)

Ubuntu Pro