12/06/2025, commit https://git.launchpad.net/snap-core22/tree/7c3b8a59559a1d01f35830501a6ef478213ae767

[ Changes in the core22 snap ]

No detected changes for the core22 snap

[ Changes in primed packages ]

libapt-pkg6.0:amd64 (built from apt) updated from 2.4.13 to 2.4.14:

  apt (2.4.14) jammy; urgency=medium

    * Fix buffer overflow, stack overflow, exponential complexity in
      apt-ftparchive Contents generation (LP: #2083697)
      - ftparchive: Mystrdup: Add safety check and bump buffer size
      - ftparchive: contents: Avoid exponential complexity and overflows
      - test framework: Improve valgrind support
      - test: Check that apt-ftparchive handles deep paths
      - increase valgrind cleanliness to make the tests pass
        - pkgcachegen: Use placement new to construct header
        - Workaround valgrind "invalid read" in ExtractTar::Go by moving large
          buffer from stack to heap. The large buffer triggered some bugs in
          valgrind stack clash protection handling.

   -- Julian Andres Klode <juliank@ubuntu.com>  Tue, 22 Oct 2024 15:09:58 +0200

cloud-init (built from cloud-init) updated from 24.4.1-0ubuntu0~22.04.2 to 25.1.2-0ubuntu0~22.04.2:

  cloud-init (25.1.2-0ubuntu0~22.04.2) jammy; urgency=medium

    * New bugfix release. (LP: #2113797)
      - Revert relocation of systemd units and service files from /usr/lib
        back to /lib so debhelper correctly enables cloud-init services in
        postinst

   -- Chad Smith <chad.smith@canonical.com>  Mon, 09 Jun 2025 17:00:37 -0600

  cloud-init (25.1.2-0ubuntu0~22.04.1) jammy; urgency=medium

    * Upstream snapshot based on 25.1.2. (LP: #2104165).
      List of changes from upstream can be found at
      https://raw.githubusercontent.com/canonical/cloud-init/25.1.2/ChangeLog

   -- James Falcon <james.falcon@canonical.com>  Fri, 02 May 2025 12:47:51 -0500

  cloud-init (25.1.1-0ubuntu1~22.04.1) jammy; urgency=medium

    * Drop cpicks which are now upstream:
      - d/p/cpick-d75840be-fix-retry-AWS-hotplug-for-async-IMDS-5995
      - d/p/cpick-84806336-chore-Add-feature-flag-for-manual-network-waiting
      - d/p/cpick-c60771d8-test-pytestify-test_url_helper.py
      - d/p/cpick-8810a2dc-test-Remove-CiTestCase-from-test_url_helper.py
      - d/p/cpick-582f16c1-test-add-OauthUrlHelper-tests
      - d/p/cpick-9311e066-fix-Update-OauthUrlHelper-to-use-readurl-exception_cb
    * refresh patches
      - d/p/deprecation-version-boundary.patch
      - d/p/no-single-process.patch
      - d/p/retain-ec2-default-net-update-events.patch
      - d/p/revert-551f560d-cloud-config-after-snap-seeding.patch
    * sort hunks within all patches (--sort on quilt refresh)
    * d/cloud-init.templates:
      - Move VMware before OVF. See GH-4030
      - Enable CloudCIX by default
    * Upstream snapshot based on 25.1.1.
      List of changes from upstream can be found at
      https://raw.githubusercontent.com/canonical/cloud-init/25.1.1/ChangeLog

   -- Chad Smith <chad.smith@canonical.com>  Tue, 25 Mar 2025 10:33:28 -0600

python3-pkg-resources, python3-setuptools (built from setuptools) updated from 59.6.0-1.2ubuntu0.22.04.2 to 59.6.0-1.2ubuntu0.22.04.3:

  setuptools (59.6.0-1.2ubuntu0.22.04.3) jammy-security; urgency=medium

    * SECURITY UPDATE: path traversal vulnerability
      - debian/patches/CVE-2025-47273-pre1.patch: Extract
        _resolve_download_filename with test.
      - debian/patches/CVE-2025-47273.patch: Add a check to ensure the name
        resolves relative to the tmpdir.
      - CVE-2025-47273

   -- Fabian Toepfer <fabian.toepfer@canonical.com>  Wed, 28 May 2025 19:13:58 +0200

libpam-systemd:amd64, libsystemd0:amd64, libudev1:amd64, systemd, systemd-sysv, systemd-timesyncd, udev (built from systemd) updated from 249.11-0ubuntu3.15 to 249.11-0ubuntu3.16:

  systemd (249.11-0ubuntu3.16) jammy-security; urgency=medium

    * SECURITY UPDATE: race condition in systemd-coredump
      - debian/patches/CVE_2025_4598_1.patch: coredump: get rid of
        _META_MANDATORY_MAX.
      - debian/patches/CVE_2025_4598_2.patch: coredump: use %d in kernel core
        pattern.
      - debian/patches/CVE_2025_4598_3.patch: coredump: get rid of a bogus
        assertion.
      - CVE-2025-4598

   -- Octavio Galland <octavio.galland@canonical.com>  Wed, 04 Jun 2025 11:17:43 -0300