Vulnérabilités de la pile Systèmes d’exploitation · Page n° 98

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143

• Mettez à jour vers 1.28.8-1

Security update for php8

This update for php8 fixes the following issue: Update to php 8.4.27: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).

• Mettez à jour vers 8.4.27-160000.1.1

Security update for php8

This update for php8 fixes the following issue: Update to php 8.4.27: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).

• Mettez à jour vers 8.4.27-160000.1.1

pypdf: Possible large memory usage for streams with multiple filters

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.

• Mettez à jour vers 6.20.0
• Mettez à jour vers 6.21.0-1

pypdf: Possible infinite loop when hitting EOF in standard xref table

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

• Mettez à jour vers 6.20.0
• Mettez à jour vers 6.21.0-1

pypdf: Possible infinite loop when removing tree items

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

• Mettez à jour vers 6.20.1
• Mettez à jour vers 6.21.0-1

pypdf: Possible infinite loop in PdfWriter.find_outline_item

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

• Mettez à jour vers 6.20.1
• Mettez à jour vers 6.21.0-1

Security update for tiff

This update for tiff fixes the following issue: - CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough (bsc#1280164).

• Mettez à jour vers 4.0.9-150000.45.72.1

Security update for php8

This update for php8 fixes the following issue: Update to php 8.3.36: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).

• Mettez à jour vers 8.3.36-150700.3.24.1

Security update for php8

This update for php8 fixes the following issue: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).

• Mettez à jour vers 8.2.35-150600.3.39.1

pypdf: Possible large memory usage when parsing content streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

• Mettez à jour vers 6.21.0
• Mettez à jour vers 6.21.0-1

pypdf: Possible large memory usage when parsing arrays and dictionaries

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

• Mettez à jour vers 6.21.0
• Mettez à jour vers 6.21.0-1

pypdf: Possible long runtimes/large memory usage when retrieving form fields

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.

• Mettez à jour vers 6.21.0
• Mettez à jour vers 6.21.0-1

Out-of-bounds Read in ntpsec

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

• Mettez à jour vers 1.2.6

Out-of-bounds Read in ntpsec

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.

• Mettez à jour vers 1.2.6

Heap-based Buffer Overflow in ntpsec

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

• Mettez à jour vers 1.2.6

Reachable Assertion in ntpsec

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.

• Mettez à jour vers 1.2.6

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.

Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Audio Announcement Service UUID.

• Mettez à jour vers 6.1.178
• Mettez à jour vers 6.1.180-1
• Mettez à jour vers 6.7.7-1

bpf: Infer zext_dst based on static register liveness analysis

In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zext_dst based on static register liveness analysis As reported in the thread [1], the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on s390 architecture. According to BPF semantics, operation `w1 += 1` is supposed to zero extend the upper half of the register `r1`. On s390 the JIT relies on the verifier emitting explicit zero extension before such operations. The verifier attempts to minimize the amount of zero extensions inserted by tracking whether upper halves of the 64-bit