Schwachstellen im Stack Betriebssysteme · Seite 170

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

• Auf 0:1.28-2.hum1 aktualisieren

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

• Auf 0:4.2.0-1.hum1 aktualisieren

Security update for libXi

This update for libXi fixes the following issues: - CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState() (bsc#1281605). - CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() (bsc#1281606). - CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser (bsc#1281608). - CVE-2026-93544: Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing (bsc#1281609). - CVE-2026-93545: Out-of-bounds read in libXi's XListInputDevices() (bsc#1281612). - CVE-2026-94281: Out-of-bounds read in libXi's XListInputDevices() class parsing (bsc#1281615). - CVE-2026-94282: Out-of-bounds read in li

• Auf 1.8.1-159998.1.1 aktualisieren

Security update for rekor

This update for rekor rebuilds it against the current go security release.

• Auf 1.4.3-150400.4.40.1 aktualisieren

Security update for unbound

This update for unbound fixes the following issues: - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403). - CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404). - CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405). - CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406). - CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409). - CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411). - CVE-2026-827

• Auf 1.26.1-slfo.1.1_1.1 aktualisieren

QBinaryJson::fromBinaryData() integer overflow leading to OOB read

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.

Security update for suseconnect-ng

This update for suseconnect-ng fixes the following issue: - Update version to 1.23.0: - Use product identifier for product migrations. (bsc#1268596) - Switch to using go1.26-openssl as the default Go version to install to support building the package (jsc#SCC-843, bsc#1268900). - Fix flag parsing so that unknown flags or options are flagged as an error and the usage message is displayed. (bsc#1159776) - InstallReleasePackage interactive/noninteractive handling should be consistent with DistUpgrade (bsc#1267478). - Add new optional rpm_packages collector, disabled by default, to collect list of installed SUSE v

• Auf 1.23.0-150500.3.48.1 aktualisieren

Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the KMS implementation does not perform host validation and makes use of the provided KMS URL, a KMS token can be sent to a malicious ho

• Auf 26.0.0 aktualisieren

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn iner

• Auf 2.4.8 aktualisieren
• Auf 3.1.9 aktualisieren
• Auf 4.2.3 aktualisieren
• Auf 8.20.0~ds+~cs7.2.4-1 aktualisieren

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript UR

• Auf 2.4.8 aktualisieren
• Auf 3.1.9 aktualisieren
• Auf 4.2.3 aktualisieren
• Auf 8.20.0~ds+~cs7.2.4-1 aktualisieren

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or out

• Auf 2.4.8 aktualisieren
• Auf 3.1.9 aktualisieren
• Auf 4.2.3 aktualisieren
• Auf 8.20.0~ds+~cs7.2.4-1 aktualisieren

fast-uri vulnerable to improper path equivalence in relative reference normalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key,

• Auf 2.4.8 aktualisieren
• Auf 3.1.9 aktualisieren
• Auf 4.2.3 aktualisieren
• Auf 8.20.0~ds+~cs7.2.4-1 aktualisieren

Security update for libX11

This update for libX11 fixes the following issues: - CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow (bsc#1280910). - CVE-2026-94283: Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (bsc#1281653). - CVE-2026-94284: Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser (bsc#1281657). - CVE-2026-94285: Out-of-bounds read in libX11's byte-oriented codeset parser (bsc#1281661).

• Auf 1.8.7-159998.1.1 aktualisieren

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

• Auf 1.6.20 aktualisieren
• Auf 1.6.20+dfsg-0+deb13u1 aktualisieren
• Auf 1.6.20+dfsg-1 aktualisieren
• Auf 1.7.5 aktualisieren

CVE-2026-109831

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.

• Auf 0.21.12 aktualisieren
• Auf 0.21.13-1 aktualisieren

Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

• Auf 1.2.0 aktualisieren

Security update for the Linux Kernel (Live Patch 34 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.133 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

• Auf 15-150500.2.1 aktualisieren

Important: gimp:2.8 security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947) * gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948) * gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248) * gimp: gimp: out-of-bounds write in GIMPres

• Auf 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 aktualisieren
• Auf 0:2.24.0-25.module+el8.9.0+1723+9bc93544 aktualisieren
• Auf 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 aktualisieren
• Auf 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 aktualisieren
• Auf 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 aktualisieren
• Auf 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 aktualisieren
• Auf 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 aktualisieren
• Auf 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 aktualisieren
• Auf 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 aktualisieren
• Auf 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 aktualisieren

vexctl-0.4.4+git106.aa6ffc8-1.1 on GA media

These are all security issues fixed in the vexctl-0.4.4+git106.aa6ffc8-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 0.4.4+git106.aa6ffc8-1.1 aktualisieren

trivy-0.76.0-1.1 on GA media

These are all security issues fixed in the trivy-0.76.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 0.76.0-1.1 aktualisieren