Schwachstellen im Stack Betriebssysteme · Seite 88

Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.

• Auf 3.3.0 aktualisieren

Mistune before 3.3.0 Stored XSS via Include Directive HTML Files

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.

• Auf 3.3.0 aktualisieren

Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

• Auf 3.3.0 aktualisieren

Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.

• Auf 3.3.0 aktualisieren

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

• Auf 3.3.0 aktualisieren

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

• Auf 1.2.3 aktualisieren

fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and requ

• Auf 2.8.8 aktualisieren
• Auf 2.8.8-1 aktualisieren

fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.

• Auf 2.8.8 aktualisieren
• Auf 2.8.8-1 aktualisieren

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.

• Auf 4.0.9 aktualisieren

Pre-boot RCE in EDK II PXE driver

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

dnspython dns.name.from_wire_parser() excessive CPU use

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

• Auf 2.9.0 aktualisieren

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can

• Auf 3.2.12 aktualisieren
• Auf 3.2.12-1 aktualisieren
• Auf 3.3.0rc1 aktualisieren

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

• Auf 3.2.12 aktualisieren
• Auf 3.2.12-1 aktualisieren
• Auf 3.3.0rc1 aktualisieren

Security update for php74

This update for php74 fixes the following issues: Fixed two security issues: - CVE-2026-109618: memory corruption leading to RCE - CVE-2026-109619: memory corruption leading to RCE

• Auf 7.4.33-1.74.1 aktualisieren

Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335). Changes for cpupower: - intel-speed-select: Harden daemon pidfile open (git-fixes, bsc#1278335, CVE-2026-80663) - turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes) - cpupower: Reset errno before strtoull() (stable-fixes) - intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes) - cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes) - cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes) - cpufreq: Fix a bug where the -

• Auf 6.12.0-160000.3.1 aktualisieren

Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335). Changes for cpupower: - intel-speed-select: Harden daemon pidfile open (git-fixes, bsc#1278335, CVE-2026-80663) - turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes) - cpupower: Reset errno before strtoull() (stable-fixes) - intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes) - cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes) - cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes) - cpufreq: Fix a bug where the -

• Auf 6.12.0-160000.3.1 aktualisieren

Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335). Changes for cpupower: - intel-speed-select: Harden daemon pidfile open (git-fixes, bsc#1278335, CVE-2026-80663) - turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes) - cpupower: Reset errno before strtoull() (stable-fixes) - intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes) - cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes) - cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes) - cpufreq: Fix a bug where the -

• Auf 6.12.0-160000.3.1 aktualisieren

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or

• Auf 1.45.1 aktualisieren
• Auf 1.45.1-1 aktualisieren

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: - CVE-2026-64718: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (bsc#1277001). - CVE-2026-65335: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (bsc#1277015). - CVE-2026-78376: use-after-free of `JSCValue` function parameters (bsc#1276418). - CVE-2026-83596: webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (bsc#1277755). Non security issue fixed: - libjavascriptcoregtk-4_0-18: JSGlobalContextCreate() aborts on aarch64 64 KB-pag

• Auf 2.54.1-150400.4.157.4 aktualisieren
• Auf 2.54.1-150400.4.157.5 aktualisieren

Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.10 (bsc#1255111, jsc#SLE-18320): - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766). - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767). - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768). - CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769). - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78667: net/http:

• Auf 1.26.10-150000.1.21.2 aktualisieren