Vulnerabilidades de la pila Sistemas operativos · Página 159

virtualenv: Downloaded wheel selection and caching precede verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without v

• Actualiza a 21.14.9

virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.

• Actualiza a 21.14.10

Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues: The following security issues were fixed: - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

• Actualiza a 4-2.1

Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576). - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-

• Actualiza a 1.35.0-10.12.1

follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in re

• Actualiza a 1.16.1
• Actualiza a 1.16.1+~1.14.4-1

Security update for bind

This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433). - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435). - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436). - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildc

• Actualiza a 9.16.50-150500.8.46.1

xz-utils vulnerability

It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.

• Actualiza a 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3
• Actualiza a 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3
• Actualiza a 5.2.2-1.3ubuntu0.1+esm2
• Actualiza a 5.2.4-1ubuntu1.1+esm2
• Actualiza a 5.2.5-2ubuntu1.2
• Actualiza a 5.6.1+really5.4.5-1ubuntu0.4
• Actualiza a 5.8.3-1ubuntu0.1
• Actualiza a 5.8.3-1ubuntu1

ca-certificates update

This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.

• Actualiza a 20260816ubuntu0.22.04.1
• Actualiza a 20260816ubuntu0.24.04.1
• Actualiza a 20260816ubuntu0.26.04.1
• Actualiza a 20260816ubuntu0.26.10.1

Security update for yt-dlp

This update for yt-dlp fixes the following issues: Changes in yt-dlp: Update to version 2026.08.19: * utils: float_or_none: Catch OverflowError * americastestkitchen: Fix season/series extraction * apple: Rework extractors * ard: Remove dead extractor * bandcamp: Support browser impersonation * bfmtv: Fix extractor * instagram: Fix logged-in extraction * showroom: Rework extractors * tiktok: Fix extractor * tiktok: Fix formats extraction * tiktok: Support share URLs * twitter: broadcast: Fix events handling * vimeo: Remove ios and macos clients * whyp: Fix extractor * youtube: Add visionos player client * yo

• Actualiza a 2026.08.19-bp160.1.1

Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Actualiza a 3.5.3

Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Actualiza a 3.5.3

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.

• Actualiza a 3.0.20.0
• Actualiza a 3.1.15.0
• Actualiza a 3.2.0.3-beta1

HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.

HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.

Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Actualiza a 3.5.3

Apache CouchDB: Replicator follows redirects indefinitely

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Actualiza a 3.5.3

Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Actualiza a 3.5.3

Apache CouchDB: Admin credentials leading to code execution as operating system user

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Actualiza a 3.5.3