QSN-8840-1: libevent vulnerabilities
2026-09-28

Summary:
Several security issues were fixed in libevent.

Details:
Michał Majchrowicz and Marcin Wyczechowski discovered that libevent
incorrectly handled certain DNS responses. A remote attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-63387)

It was discovered that libevent incorrectly handled certain connections. A
local attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-63388)

Affected QuantaStor releases:
  6.9.1.001 jammy: libevent-core-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.9.1.001 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.9.0.464 jammy: libevent-core-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.9.0.464 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.6.015 jammy: libevent-core-2.1-7 2.1.12-stable-1ubuntu0.1 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.6.015 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1ubuntu0.1 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.5.018 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.5.018 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.4.038 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.4.038 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.3.018 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.3.018 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.2.002 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.2.002 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.1.007 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.1.007 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.0.205 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)
  6.8.0.205 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.2)

CVEs: CVE-2026-63387, CVE-2026-63388

References:
  https://ubuntu.com/security/notices/USN-8840-1