Vulnérabilités de la pile Systèmes d’exploitation · Page n° 99

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.

Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Audio Announcement Service UUID.

• Mettez à jour vers 6.1.178
• Mettez à jour vers 6.1.180-1
• Mettez à jour vers 6.7.7-1

bpf: Infer zext_dst based on static register liveness analysis

In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zext_dst based on static register liveness analysis As reported in the thread [1], the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on s390 architecture. According to BPF semantics, operation `w1 += 1` is supposed to zero extend the upper half of the register `r1`. On s390 the JIT relies on the verifier emitting explicit zero extension before such operations. The verifier attempts to minimize the amount of zero extensions inserted by tracking whether upper halves of the 64-bit

pypdf: Unvalidated JPEG image data loading

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

• Mettez à jour vers 6.21.1
• Mettez à jour vers 6.21.1-1

Security update for buildah

This update for buildah rebuilds it against the current go security release.

• Mettez à jour vers 1.35.5-150500.3.68.1

RCE via stale global state

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

• Mettez à jour vers 5.5.9+dfsg-1ubuntu4.29+esm18
• Mettez à jour vers 7.0.33-0ubuntu0.16.04.16+esm22
• Mettez à jour vers 7.2.24-0ubuntu0.18.04.17+esm14
• Mettez à jour vers 7.4.3-4ubuntu2.29+esm5
• Mettez à jour vers 8.1.2-1ubuntu2.28
• Mettez à jour vers 8.2.35
• Mettez à jour vers 8.2.35-1~deb12u1
• Mettez à jour vers 8.3.36
• Mettez à jour vers 8.3.6-0ubuntu0.24.04.13
• Mettez à jour vers 8.4.27
• Mettez à jour vers 8.4.27-1
• Mettez à jour vers 8.4.27-1~deb13u1
• Mettez à jour vers 8.5.12
• Mettez à jour vers 8.5.4-0ubuntu1.5
• Mettez à jour vers 8.5.9-0ubuntu2.1

Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

• Mettez à jour vers 5.4.0

RCE via OOM corruption

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

• Mettez à jour vers 5.5.9+dfsg-1ubuntu4.29+esm18
• Mettez à jour vers 7.0.33-0ubuntu0.16.04.16+esm22
• Mettez à jour vers 7.2.24-0ubuntu0.18.04.17+esm14
• Mettez à jour vers 7.4.3-4ubuntu2.29+esm5
• Mettez à jour vers 8.1.2-1ubuntu2.28
• Mettez à jour vers 8.2.35
• Mettez à jour vers 8.2.35-1~deb12u1
• Mettez à jour vers 8.3.36
• Mettez à jour vers 8.3.6-0ubuntu0.24.04.13
• Mettez à jour vers 8.4.27
• Mettez à jour vers 8.4.27-1
• Mettez à jour vers 8.4.27-1~deb13u1
• Mettez à jour vers 8.5.12
• Mettez à jour vers 8.5.4-0ubuntu1.5
• Mettez à jour vers 8.5.9-0ubuntu2.1

ALPINE-CVE-2026-97313

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 9.20.30-r0

ALPINE-CVE-2026-96888

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 9.20.30-r0

ALPINE-CVE-2026-94300

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 9.20.30-r0

ALPINE-CVE-2026-19630

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 9.20.30-r0

Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687).

• Mettez à jour vers 2.1.28-150600.7.17.1

Security update for xwayland

This update for xwayland fixes the following issues: - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213). - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218). - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220). - CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225). - CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227). - CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233). - CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236). - CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer O

• Mettez à jour vers 24.1.5-150700.3.25.1

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493): - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component. - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component. - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component. - CVE-2026-109709: Information disclosure

• Mettez à jour vers 153.5.0-150400.157.16.1

Security update for python-hpack

This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime (bsc#1283035).

• Mettez à jour vers 4.0.0-150400.8.6.1

Specific RPZ configurations and query patterns may result in an unexpected exit

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 1:9.20.30-1
• Mettez à jour vers 1:9.20.30-1~deb13u1

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 1:9.20.30-1
• Mettez à jour vers 1:9.20.30-1~deb13u1

Concurrent GSS-TSIG messages corrupt memory

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 1:9.20.30-1
• Mettez à jour vers 1:9.20.30-1~deb13u1

Amplified resource exhaustion in inbound message processing

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Mettez à jour vers 1:9.20.30-1
• Mettez à jour vers 1:9.20.30-1~deb13u1