p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Betriebssysteme · Seite 160

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Betriebssysteme: 6808. Davon im KEV-Katalog: 4.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Betriebssysteme

Sicherheitslücken: 160891

  1. SUSE-SU-2026:4768-1

    Nicht bewertetKorrektur verfügbar

    Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)

    This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.163 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

    kernel-livepatch-sle15-sp5_update_39Betriebssysteme
    • Auf 9-150500.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. SUSE-SU-2026:24265-1

    Nicht bewertetKorrektur verfügbar

    Security update for amazon-ecs-init

    This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042). - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679). Changes for amazon-ecs-init: - Update to version 1.108.0 * Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161) * Enhancement - Remove direct docker run instructions fro

    amazon-ecs-init amazon-ecs-initBetriebssysteme
    • Auf 1.108.0-160000.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. SUSE-SU-2026:24378-1

    Nicht bewertetKorrektur verfügbar

    Security update for podman

    This update for podman fixes the following issues: - CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579). - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).

    podmanBetriebssysteme
    • Auf 5.4.2-slfo.1.1_6.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. SUSE-SU-2026:24377-1

    Nicht bewertetKorrektur verfügbar

    Security update for python-PyJWT

    This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060). - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061). - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064). - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065). - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066). - CVE-2026-102270: an attac

    python-pyjwtBetriebssysteme
    • Auf 2.12.1-slfo.1.1_3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. openSUSE-SU-2026:22145-1

    Nicht bewertetKorrektur verfügbar

    Security update for amazon-ecs-init

    This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042). - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679). Changes for amazon-ecs-init: - Update to version 1.108.0 * Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161) * Enhancement - Remove direct docker run instructions fro

    amazon-ecs-initBetriebssysteme
    • Auf 1.108.0-160000.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-112947

    Mittel · CVSS 6.3EPSS 0,5%Öffentlicher ExploitKorrektur verfügbar

    Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.

    vite vite-plus vite vite vite-plus vite vite vite vite vite vite viteBetriebssysteme Node.js
    • Auf 1.1.0 aktualisieren
    • Auf 8.2.4 aktualisieren
    • Auf 8.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-112946

    Mittel · CVSS 6.3EPSS 0,85%Öffentlicher ExploitKorrektur verfügbar

    Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by

    vite vite-plus vite vite vite vite vite vite-plus vite vite vite viteBetriebssysteme Node.js
    • Auf 1.1.0 aktualisieren
    • Auf 6.4.4 aktualisieren
    • Auf 7.3.7 aktualisieren
    • Auf 8.1.6 aktualisieren
    • Auf 8.2.4 aktualisieren
    • Auf 8.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-112945

    Niedrig · CVSS 2.1EPSS 0,67%Öffentlicher ExploitKorrektur verfügbar

    Vite: Cross origin script execution through Vite custom middleware

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execut

    vite vite-plus vite vite vite vite vite vite-plus vite vite vite viteBetriebssysteme Node.js
    • Auf 1.1.0 aktualisieren
    • Auf 6.4.4 aktualisieren
    • Auf 7.3.7 aktualisieren
    • Auf 8.1.6 aktualisieren
    • Auf 8.2.4 aktualisieren
    • Auf 8.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-112941

    Niedrig · CVSS 3.3EPSS 0,13%Öffentlicher ExploitKorrektur verfügbar

    filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

    filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-112940

    Hoch · CVSS 7.1EPSS 0,19%Korrektur verfügbar

    filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-92162

    Hoch · CVSS 7.2EPSS 0,23%Korrektur verfügbar

    Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privi

    flatpak flatpak flatpak flatpak flatpak flatpak flatpak flatpak flatpakBetriebssysteme
    • Auf 1.16.6-1~deb13u3 aktualisieren
    • Auf 1.18.1-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-112939

    Mittel · CVSS 4.7EPSS 0,14%Korrektur verfügbar

    filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

    filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-112937

    Mittel · CVSS 6.1EPSS 0,16%Korrektur verfügbar

    filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

    filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-112936

    Mittel · CVSS 6.1EPSS 0,23%Öffentlicher ExploitKorrektur verfügbar

    filelock: ReadWriteLock follows a symlink at the lock path into SQLite

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.0.12-1 aktualisieren
    • Auf 4.0.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-112935

    Mittel · CVSS 4.7EPSS 0,13%Korrektur verfügbar

    filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

    filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-112934

    Mittel · CVSS 6.1EPSS 0,23%Korrektur verfügbar

    filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

    filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. openSUSE-SU-2026:22143-1

    Nicht bewertetKorrektur verfügbar

    Security update for guava

    This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985). Changes for guava: - Adapt the generated OSGi data to reality - Upgrade to guava 33.7.2 * Changes of 33.7.2 + collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (bsc#1284985, CVE-2026-102554) * Changes of 33.7.1 + removes the Multi-Release line from our jar manifest, fixing an iss

    guavaBetriebssysteme
    • Auf 33.7.2-160000.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-112915

    Mittel · CVSS 5.5EPSS 0,22%Korrektur verfügbar

    filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-112914

    Mittel · CVSS 5.3EPSS 0,16%Korrektur verfügbar

    filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

    filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.

    filelock python-filelock python-filelock python-filelock filelock python-filelock python-filelock python-filelock python-filelock python-filelock python-filelockBetriebssysteme Python
    • Auf 4.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. USN-8708-2

    Nicht bewertetKorrektur verfügbar

    rust-sudo-rs vulnerability

    USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10. Original advisory details: It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.

    rust-sudo-rsBetriebssysteme
    • Auf 0.2.14-1ubuntu4.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →