Operating systems stack vulnerabilities · Page 152

Important: python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the

• Update to 0:2.6.3-2.el9_8.6

Important: xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer over

• Update to 0:1.20.11-34.el9_8.5

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields (CVE-2026-82397) * python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVE-2024-14029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Update to 0:0.10.18-2.el8_10.10

Critical: webkit2gtk3 security, bug fix, and enhancement update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read (CVE-2026-87596) * chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page (CVE-2026-87500) * chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE (CVE-2026-87654) * chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability (CVE-2026-87621) * chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnera

• Update to 0:2.54.1-1.el8_10

Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Update to 0:1.73-4.el8_10

Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fix(es): * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556) * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557) * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558) * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed

• Update to 0:2.62.3-19.el8_10

Security update for the Linux Kernel (Live Patch 37 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.144 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

• Update to 11-150500.2.1
• Update to 17-2.1

Security update for gcc13

This update for gcc13 fixes the following issues: Security issue fixed: - CVE-2026-102010: UAF due to improper pointer update when an application calls the `erase_if` function on a binary heap priority queue in `libstdc++` (bsc#1283123). Non security issue fixed: - Multiple cross-arm-none-gcc13 bugs (bsc#1219031). Changes for gcc13: - Update to final GCC 13.5

• Update to 13.5.0+git10516-159998.1.1

ALPINE-CVE-2026-113351

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

• Update to 2.10.0-r0

Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments

A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.

Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments

A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.

Security update for python3

This update for python3 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599 bsc#1274743). - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429 bsc#1262467). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-3446:

• Update to 3.6.15-150300.10.129.1

Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912). - CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop (bsc#1284662). - CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing an infinite loop and DoS (bsc#1284664). - CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop (bsc#1284665). - CVE-2026-106571: a crafted local call to the GetVirtualPixels API can t

• Update to 6.8.8.1-71.280.1

DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

• Update to 2026-07-14.c+dfsg-1
• Update to 2026-07-14c

uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

Red Hat Security Advisory: rust-sequoia-sq security update

Red Hat Security Advisory: rust-sequoia-sq security update

• Update to 0:1.4.0.1-4.el10_2

Red Hat Security Advisory: openssh security update

Red Hat Security Advisory: openssh security update

• Update to 0:9.9p1-29.el10_2

Red Hat Security Advisory: postgresql:18 security update

Red Hat Security Advisory: postgresql:18 security update

• Update to 0:0.8.7-1.module+el9.8.0+25065+515b563e
• Update to 0:1.5.3-1.module+el9.8.0+23739+1c42644c
• Update to 0:18.0-1.module+el9.8.0+23739+1c42644c
• Update to 0:3.6.1-4.module+el9.8.0+24879+1364ef12

Red Hat Security Advisory: postgresql:16 security update

Red Hat Security Advisory: postgresql:16 security update

• Update to 0:0.8.7-1.module+el9.8.0+25064+c8e71655
• Update to 0:1.5.1-1.module+el9.8.0+24090+8f0ee565
• Update to 0:16.0-1.module+el9.8.0+24090+8f0ee565
• Update to 0:3.5.3-6.module+el9.8.0+24839+3a67b9ca