Operating systems stack vulnerabilities · Page 90

Security update for php7

This update for php7 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981). - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216). - CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980). - CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875). - CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876). - CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877). - CVE-2026-91768: Access control byp

• Update to 7.4.33-150400.4.81.1
• Update to 7.4.33-150400.4.81.2

Security update for php8

This update for php8 fixes the following issue: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).

• Update to 8.0.30-150400.4.80.1
• Update to 8.0.30-150400.4.80.2

Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issues: Security issue fixed: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687). Non security issues fixed: - Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863). - Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498). - Make DIGEST-MD5 work with openssl3 (bsc#1230111).

• Update to 2.1.28-slfo.1.1_2.1

Mod_qos: query truncation during json body merging permits security-rule bypass

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.

Mod_qos: out-of-bounds reads in response-body substring matching

A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow

A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.

Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads

A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

• Update to 1.11.14-ee11
• Update to 3.0.16-ee17
• Update to 3.2.17
• Update to 3.2.17-ee1
• Update to 3.2.26
• Update to 3.2.26-1
• Update to 3.3.17
• Update to 3.4.6
• Update to 3.5-dev9

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

• Update to 1.11.14-ee11
• Update to 2.6.12-1+deb12u4
• Update to 3.0.11-1+deb13u4
• Update to 3.0.16-ee17
• Update to 3.0.30
• Update to 3.2.17
• Update to 3.2.17-ee1
• Update to 3.2.26
• Update to 3.2.26-1
• Update to 3.3.17
• Update to 3.4.6
• Update to 3.5-dev9

CVE-2026-114732

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114727

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via References/In-Reply-To/Message-ID/From parameters”, which normalizes whitespace in every string header value.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.

• Update to 1.6.20
• Update to 1.6.20+dfsg-0+deb13u1
• Update to 1.6.20+dfsg-1
• Update to 1.7.5