Skip to content
OpenAdvisories
Low USN-8229-2 1 CVE

sed vulnerability

Published May 28, 2026 · Updated May 29, 2026

Ecosystem: Ubuntu

Summary

USN-8229-1 fixed a vulnerability in sed. This update provides the
corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

Michał Majchrowicz and Marcin Wyczechowski discovered that sed
incorrectly handled symbolic links when performing in-place edits.
A local attacker could possibly use this issue to overwrite
arbitrary files.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS sed 4.4-2ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS sed 4.7-1ubuntu0.1~esm1

Vulnerabilities 1

  • Low 2.1
    CVE-2026-5958

    Race Condition in GNU Sed

    When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when…

    GNU Sed sed sed Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-5958