Threat database

A vulnerability in xdg-dbus-proxy prior to version 0.1.2-3.oe2203sp4 allows attackers to bypass message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. This flaw can enable a malicious or compromised Flatpak application to execute arbitrary code outside its sandbox. xdg-dbus-proxy is used as a sandbox boundary component for Flatpak and other app frameworks such as Firejail. The issue is fixed in version 0.1.2-3.oe2203sp4.

A timing and cache side-channel vulnerability exists in OpenSSL's SM2 private key operations on ARM64 and RISC-V platforms due to a non-constant-time scalar multiplication implementation. This flaw allows an attacker who can measure timing or cache access patterns during SM2 signing or decryption to potentially learn information about the secret scalar. The issue affects OpenSSL versions 4.0, 3.6, 3.5, and 3.4 on these architectures. Versions 3.0, 1.1.1, and 1.0.2 are not affected. Fixes are available in OpenSSL 4.0.3, 3.6.5, 3.5.9, and 3.4.8.

Multiple security vulnerabilities exist in Apache HTTP Server mod_auth_digest before version 2.4.69. These include missing authentication checks allowing unauthenticated denial of service, authentication bypass via replay attacks under certain configurations, and use-after-free conditions causing authentication state corruption. All issues are resolved in version 2.4.69.

PipeWire versions prior to 0.3.63-7.oe2403sp1 contain multiple unbounded alloca() calls in the PulseAudio protocol server, leading to a vulnerability (CVE-2026-14330). This flaw allows an attacker with minimal permissions inside a sandboxed environment, such as Flatpak, to escape the sandbox by exploiting PipeWire's PulseAudio compatibility layer. The attacker can load a malicious library, resulting in arbitrary code execution outside the sandbox and potential full compromise of the user's system. A fix is available in version 0.3.63-7.oe2403sp1.

GNU Aspell versions prior to 0.60.8.1-2.oe2403sp4 contain multiple heap-based buffer overflow and out-of-bounds read vulnerabilities in their dictionary loading and decompression components. These flaws allow an attacker to cause heap memory corruption, denial of service, memory disclosure, and potentially remote code execution by tricking a user into loading crafted dictionary or compressed files. The issues are fixed in version 0.60.8.1-2.oe2403sp4 and later.

A vulnerability in python-urllib3 versions prior to 1.26.18-11.oe2403sp3 causes target-server TLS settings to be incorrectly applied to HTTPS proxy connections. This allows an attacker who can intercept and impersonate the HTTPS proxy to observe or modify forwarded traffic or receive a target TLS client certificate. The issue is fixed in version 1.26.18-11.oe2403sp3.

A shell command injection vulnerability exists in libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 when built with the libssh2 SSH backend. The vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters. This occurs due to improper escaping in the gen_proto() function, which inserts the repository path directly into a shell command string. The issue can be triggered by crafting a malicious submodule URL in a .gitmodules file during a recursive clone operation.