A heap-based out-of-bounds read vulnerability exists in libical through version 4.0.6 in the function icalvalue_decode_ical_string() when decoding input that ends with a backslash. This flaw can cause the application to crash or leak adjacent heap memory when processing specially crafted escaped iCalendar text with a trailing backslash. The issue is fixed in version 3.0.17-4.oe2403sp4.
A use-after-free vulnerability in libarchive's archive_entry_copy_mac_metadata() function can lead to denial of service or potential information disclosure. The flaw occurs because an internal buffer is deallocated before data copying completes, allowing attackers supplying crafted input to crash the application or read uninitialized memory. This affects versions prior to 3.7.1-14.oe2403sp4. A patch is available to address this issue.
Multiple vulnerabilities affect NGINX Plus and NGINX Open Source, including heap buffer overflows and use-after-free conditions triggered by specific configurations involving alias, rewrite, set/return directives, regex map variables, asynchronous file I/O with SSI, and SSL session cache settings. These vulnerabilities can lead to denial-of-service (DoS), memory corruption, or potential remote code execution, especially on systems with ASLR disabled or bypassed. Additionally, a flaw in SSL session ticket key rotation can allow forging of client SSL sessions, potentially bypassing client certificate verification. These issues impact the data plane only and do not expose the control plane. Fixed versions are available.
A critical buffer overflow vulnerability exists in the Brotli decoder versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. The issue affects all platforms using these versions of the Brotli library. Fixed versions 1.1.1-1.oe2403sp3 and later are available and should be applied promptly.
Apache Tomcat versions 9.0.90 through 9.0.122, 10.1.25 through 10.1.60, and 11.0.0 through 11.0.26 contain an incomplete cleanup vulnerability that can cause TLS 1.3 connections to fail intermittently. This issue is resolved in versions 9.0.123, 10.1.61, and 11.0.27.
Apache Tomcat versions 9.0.92 through 9.0.122, 10.1.27 through 10.1.60, and 11.0.0 through 11.0.26 contain an incomplete cleanup vulnerability that allows HTTP/2 trailer header information from a previous request to leak into a subsequent request. This issue is fixed in versions 9.0.123, 10.1.61, and 11.0.27.
UnRTF, a command-line tool for converting RTF documents to various formats, has a vulnerability (CVE-2026-109831) involving an out-of-bounds write. This flaw can be triggered by opening a specially crafted RTF file, potentially causing a denial-of-service (DoS) condition. A fix is available in version 0.21.13-1.oe2403sp4.
Multiple critical security vulnerabilities have been identified in Apache Tomcat versions ranging from early milestone releases through recent stable versions up to 11.0.26, 10.1.60, and 9.0.122. These include authentication bypass, request/response mix-up in HTTP/2 asynchronous servlets, failure to securely enforce FIPS mode, execution after redirect, local unauthorized access via a TOCTOU race condition in unix domain sockets, and incomplete cleanup issues causing information leaks and TLS 1.3 connection failures. Users are strongly recommended to upgrade to fixed versions 11.0.27, 10.1.61, or 9.0.123 to address these vulnerabilities.