Operating systems stack vulnerabilities · Page 36

Moderate: freeipmi security, bug fix, and enhancement update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) * FreeIPMI: FreeIPMI: Denial of Service via stack-ba

• Update to 0:1.6.20-1.el8_10

Security update for python

This update for python fixes the following issue: - CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free (bsc#1283969).

• Update to 2.7.18-150000.139.1
• Update to 2.7.18-150000.139.2

Authentication bypass by spoofing in twofactor_gauthenticator

The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed. This issue was fixed in commit 4640889.

Insufficient session expiration in twofactor_gauthenticator

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.

Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.

Security update for suseconnect-ng

This update for suseconnect-ng rebuilds it against the current go security release.

• Update to 1.23.0-150500.3.50.1

llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.

• Update to 0.6.0
• Update to 1:0.6.0+dfsg-1

llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.

• Update to 0.6.0
• Update to 1:0.6.0+dfsg-1

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.

• Update to 10271+dfsg-1

llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.

llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to n_vocab to read embedding memory out of bounds or crash the process.

llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the process or load adjacent process memory as model weights.

Tencent RapidJSON Regex stream.h Take out-of-bounds

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: net/iucv: fix use-after-free of a severed

• Update to 0:4.18.0-553.178.1.rt7.519.el8_10

vifm-0.14.5-1.1 on GA media

These are all security issues fixed in the vifm-0.14.5-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 0.14.5-1.1

trivy-0.76.1-1.1 on GA media

These are all security issues fixed in the trivy-0.76.1-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 0.76.1-1.1

timoni-0.36.0-1.1 on GA media

These are all security issues fixed in the timoni-0.36.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 0.36.0-1.1

sdbootutil-1+git20261026.4e266f0-1.1 on GA media

These are all security issues fixed in the sdbootutil-1+git20261026.4e266f0-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 1+git20261026.4e266f0-1.1

python313-uv-0.13.6-1.1 on GA media

These are all security issues fixed in the python313-uv-0.13.6-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 0.13.6-1.1

python313-pypdf-6.21.2-1.1 on GA media

These are all security issues fixed in the python313-pypdf-6.21.2-1.1 package on the GA media of openSUSE Tumbleweed.

• Update to 6.21.2-1.1