Summary
It was discovered that NLTK incorrectly handled file extraction when
opening a maliciously crafted zip file. An attacker could possibly use this
issue to create or overwrite files on the system and execute arbitrary
code.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | nltk | 2.0~b9-0ubuntu4.1~esm5 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nltk | 3.1-1ubuntu0.1+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | nltk | 3.2.5-1ubuntu0.1+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | nltk | 3.4.5-2ubuntu0.1~esm3 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | nltk | 3.7-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | nltk | 3.8.1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | nltk | 3.9.2-1ubuntu0.1~esm1 |
References
-
report
https://ubuntu.com/security/CVE-2025-14009