Operating systems stack vulnerabilities · Page 104

Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

• Update to 1.2.8
• Update to 1.2.8-1

Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

• Update to 1.2.8
• Update to 1.2.8-1

Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

• Update to 1.2.11-1
• Update to 1.2.9

Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

• Update to 1.2.9

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

• Update to 3.32.0
• Update to 3.32.0+dfsg-0ubuntu0.24.04.1
• Update to 3.32.0+dfsg-0ubuntu0.26.04.1
• Update to 3.32.0+dfsg-1

FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.

• Update to 3.32.0
• Update to 3.32.0+dfsg-0ubuntu0.24.04.1
• Update to 3.32.0+dfsg-0ubuntu0.26.04.1
• Update to 3.32.0+dfsg-1

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.

• Update to 3.32.1
• Update to 3.32.1+dfsg-0ubuntu0.24.04.1
• Update to 3.32.1+dfsg-0ubuntu0.26.04.1
• Update to 3.32.1+dfsg-1

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized dimensions, causing android_UpdateWindowFromSurface to copy heap memory beyond the allocation, leading to crashes or memory disclosure.

• Update to 3.32.1
• Update to 3.32.1+dfsg-0ubuntu0.24.04.1
• Update to 3.32.1+dfsg-0ubuntu0.26.04.1
• Update to 3.32.1+dfsg-1

Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.

• Update to 3.32.1
• Update to 3.32.1+dfsg-0ubuntu0.24.04.1
• Update to 3.32.1+dfsg-0ubuntu0.26.04.1
• Update to 3.32.1+dfsg-1

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

• Update to 3.32.1
• Update to 3.32.1+dfsg-0ubuntu0.24.04.1
• Update to 3.32.1+dfsg-0ubuntu0.26.04.1
• Update to 3.32.1+dfsg-1

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.

• Update to 3.32.1
• Update to 3.32.1+dfsg-1

Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).

• Update to 0.15.1-1

Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Updat

• Update to 0:1.26.1-1.module+el8.10.0+40244+e7cb3ff8

stgit-2.7.0-1.1 on GA media

These are all security issues fixed in the stgit-2.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 2.7.0-1.1

libspice-server-devel-0.16.0-3.1 on GA media

These are all security issues fixed in the libspice-server-devel-0.16.0-3.1 package on the GA media of openSUSE Tumbleweed.

• Update to 0.16.0-3.1

roundcubemail-1.6.20-1.1 on GA media

These are all security issues fixed in the roundcubemail-1.6.20-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 1.6.20-1.1

regclient-0.11.7-1.1 on GA media

These are all security issues fixed in the regclient-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 0.11.7-1.1

php8-8.5.12-1.1 on GA media

These are all security issues fixed in the php8-8.5.12-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 8.5.12-1.1

perl-Text-CSV_XS-1.650.0-1.1 on GA media

These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 1.650.0-1.1