Threat database

A vulnerability in Flatpak before version 1.10.2-16.oe2403sp4 allows a local attacker to exploit symlink traversal in the revokefs writer used by the flatpak-system-helper. This flaw enables modification of files belonging to other revokefs sessions after validation, including tampering with ostree commit objects in the system repository. Successful exploitation can lead to local root privilege escalation.

Flatpak before version 1.10.2-16.oe2403sp1 contains a vulnerability where a malicious sandboxed application can replace the file ~/.var/app/$appid/.ld.so with a symbolic link. This causes the regenerate_ld_cache process to write files to arbitrary locations. However, the filenames and content written are not attacker-controlled, limiting exploitability. This issue is fixed in version 1.10.2-16.oe2403sp1.

CVE-2026-95838 is a vulnerability in containerd, an industry-standard container runtime. Prior to versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5, the layer unpack handler in containerd repeatedly traverses directories when processing certain opaque whiteout configurations. A malicious image layer can exploit this to cause repeated directory traversals, leading to high CPU usage, delayed container startup, and reduced image-pull concurrency for unrelated deployments. This issue has been fixed in the specified versions.

Libsndfile version prior to 1.0.31-7.oe2203sp4 contains a vulnerability in the psf_binheader_readf() function when parsing WAV fmt chunks. This flaw involves a misaligned memory access that can cause undefined behavior and lead to a denial of service when processing specially crafted WAV files. The issue is fixed in version 1.0.31-7.oe2203sp4.

Multiple security vulnerabilities exist in python-aiohttp versions prior to 3.14.4, including improper enforcement of the Secure cookie attribute, missing keepalive timeout handling, connection pool exhaustion, unbounded file descriptor retention in multipart requests, incorrect Request.scheme handling, host-only cookie scope removal by subdomains, and ambiguous HTTP request framing leading to request smuggling. These issues are fixed in version 3.14.4.

A heap-based buffer overflow vulnerability exists in the PNG metadata reader of Eye of GNOME (eog) due to improper state handling when parsing split metadata chunks. This flaw could be triggered by a user opening a specially crafted PNG file, potentially causing a denial of service via application crash or arbitrary code execution. The vulnerability affects versions of eog prior to 44.3-2.oe2403sp1. A security update fixing this issue is available.

A heap-based out-of-bounds read vulnerability exists in libical through version 3.0.17-4.oe2403sp1 in the function icalvalue_decode_ical_string() when decoding input that ends with a backslash. This flaw can cause application crashes or memory leakage by reading past the intended buffer boundary.