Vulnerabilidades de la pila Sistemas operativos · Página 173

Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Actualiza a 0.8.7-1.module_el9.8.0+325+9e644128
• Actualiza a 1.5.3-1.module_el9.8.0+234+5456f35d
• Actualiza a 18.0-1.module_el9.8.0+234+5456f35d
• Actualiza a 18.6-1.module_el9.8.0+310+22372bcc
• Actualiza a 3.3.1-1.Final.module_el9.8.0+234+5456f35d
• Actualiza a 3.6.1-4.module_el9.8.0+310+22372bcc

Important: postgresql:16 security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Actualiza a 0.8.7-1.module_el9.8.0+324+0cb93d9d
• Actualiza a 1.5.1-1.module_el9.6.0+146+c54fdeca
• Actualiza a 16.0-1.module_el9.4.0+66+eb9878bc
• Actualiza a 16.15-1.module_el9.8.0+311+c39b793b
• Actualiza a 2.4.0-1.Final.module_el9.4.0+66+eb9878bc
• Actualiza a 3.5.3-6.module_el9.8.0+311+c39b793b

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: sctp: stop processing a pac

• Actualiza a 4.18.0-553.176.1.rt7.517.el8_10

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) *

• Actualiza a 4.18.0-553.176.1.el8_10

CVE-2026-95168

An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py

CVE-2025-60496

A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVE-2025-60494

A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.

CVE-2025-60475

A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0.

• Actualiza a 13.0.0

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invoc

• Actualiza a 13.0.0

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.

• Actualiza a 13.0.0

Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.

• Actualiza a 13.0.0

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.

• Actualiza a 13.0.0

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume exc

• Actualiza a 13.0.0

Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.

• Actualiza a 13.0.0

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.

• Actualiza a 13.0.0

Gimp: gimp: use-after-free in xcf loader via prop_selected_path

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Security update for podman

This update for podman rebuilds it against the current go security release.

• Actualiza a 4.9.5-150400.4.83.1