Schwachstellen im Stack Betriebssysteme · Seite 85

gitoxide-0.61.0-1.1 on GA media

These are all security issues fixed in the gitoxide-0.61.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 0.61.0-1.1 aktualisieren

git-lfs-3.8.1-1.1 on GA media

These are all security issues fixed in the git-lfs-3.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 3.8.1-1.1 aktualisieren

docker-compose-5.6.1-1.1 on GA media

These are all security issues fixed in the docker-compose-5.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 5.6.1-1.1 aktualisieren

containerized-data-importer1.65-api-1.65.0-4.1 on GA media

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-4.1 package on the GA media of openSUSE Tumbleweed.

• Auf 1.65.0-4.1 aktualisieren

chromedriver-156.0.8078.47-1.1 on GA media

These are all security issues fixed in the chromedriver-156.0.8078.47-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 156.0.8078.47-1.1 aktualisieren

ca-certificates-mozilla-2.92-2.1 on GA media

These are all security issues fixed in the ca-certificates-mozilla-2.92-2.1 package on the GA media of openSUSE Tumbleweed.

• Auf 2.92-2.1 aktualisieren

brotli-1.2.1-1.1 on GA media

These are all security issues fixed in the brotli-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 1.2.1-1.1 aktualisieren

bind-9.20.30-1.1 on GA media

These are all security issues fixed in the bind-9.20.30-1.1 package on the GA media of openSUSE Tumbleweed.

• Auf 9.20.30-1.1 aktualisieren

Important: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Auf 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 aktualisieren

Important: php:8.0 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Auf 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 aktualisieren

Important: php:7.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Auf 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 aktualisieren

Important: php:7.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Auf 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 aktualisieren

Critical: ca-certificates security update

The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI). Security Fix(es): * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Auf 2026.2.92_v9.0.319-81.3.el8_10 aktualisieren

Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs

• Auf 1.9.0 aktualisieren
• Auf 1.9.1-1 aktualisieren

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/gra

• Auf 1.9.0 aktualisieren
• Auf 1.9.1-1 aktualisieren

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

• Auf 1.9.0 aktualisieren
• Auf 1.9.1-1 aktualisieren

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience

• Auf 1.9.0 aktualisieren
• Auf 1.9.1-1 aktualisieren

Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.

ALPINE-CVE-2026-114583

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

• Auf 3.12.16-r0 aktualisieren
• Auf 3.14.10-r0 aktualisieren

Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.

• Auf 1.9.1 aktualisieren
• Auf 1.9.1-1 aktualisieren