USN-7965-1: SimGear vulnerability

USN-7965-1: SimGear vulnerability

Publication date: 15 January 2026
Overview: SimGear could be made to run programs as an administrator if it opened a specially crafted file.

Packages
simgear - set of open-source libraries for assembling 3d simulations, games, and visualizations

Details
It was discovered that SimGear could be made to bypass the sandboxing of
Nasal scripts. An attacker could possibly use this issue to execute
arbitrary code.

Update instructions
The problem can be corrected by updating your system to the following package versions:

• 24.04 LTS noble libsimgear-dev – 1:2020.3.18+dfsg-2.1ubuntu0.1~esm1
• 22.04 LTS jammy libsimgear-dev – 1:2020.3.6+dfsg-1ubuntu0.1~esm2
• 20.04 LTS focal libsimgear-dev – 1:2019.1.1+dfsg-3ubuntu0.1~esm1
• 18.04 LTS bionic libsimgear-dev – 1:2018.1.1+dfsg-1ubuntu0.1~esm1

16.04 LTS xenial

• libsimgear-dev – 3.4.0-3ubuntu0.1~esm1
• libsimgearcore3.4.0v5 – 3.4.0-3ubuntu0.1~esm1
• libsimgearscene3.4.0v5 – 3.4.0-3ubuntu0.1~esm1