Threat database

PipeWire versions prior to 0.3.63-7.oe2403sp1 contain multiple unbounded alloca() calls in the PulseAudio protocol server, leading to a vulnerability (CVE-2026-14330). This flaw allows an attacker with minimal permissions inside a sandboxed environment, such as Flatpak, to escape the sandbox by exploiting PipeWire's PulseAudio compatibility layer. The attacker can load a malicious library, resulting in arbitrary code execution outside the sandbox and potential full compromise of the user's system. A fix is available in version 0.3.63-7.oe2403sp1.

GNU Aspell versions prior to 0.60.8.1-2.oe2403sp4 contain multiple heap-based buffer overflow and out-of-bounds read vulnerabilities in their dictionary loading and decompression components. These flaws allow an attacker to cause heap memory corruption, denial of service, memory disclosure, and potentially remote code execution by tricking a user into loading crafted dictionary or compressed files. The issues are fixed in version 0.60.8.1-2.oe2403sp4 and later.

A vulnerability in python-urllib3 versions prior to 1.26.18-11.oe2403sp3 causes target-server TLS settings to be incorrectly applied to HTTPS proxy connections. This allows an attacker who can intercept and impersonate the HTTPS proxy to observe or modify forwarded traffic or receive a target TLS client certificate. The issue is fixed in version 1.26.18-11.oe2403sp3.

A shell command injection vulnerability exists in libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 when built with the libssh2 SSH backend. The vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters. This occurs due to improper escaping in the gen_proto() function, which inserts the repository path directly into a shell command string. The issue can be triggered by crafting a malicious submodule URL in a .gitmodules file during a recursive clone operation.

A vulnerability in GNU patch allows an attacker to create arbitrary files outside the intended directory by using a specially crafted patch file. This occurs due to missing validation of absolute file paths during automatic patch reversal, enabling file creation with the permissions of the executing user. The flaw affects versions prior to 2.7.6-24.oe2403sp4 and has a medium severity rating.

Libwebsockets versions prior to 4.3.3-9.oe2403sp1 contain an out-of-bounds read vulnerability in the LEJP incremental parser that can be exploited remotely to cause a denial of service. This vulnerability is tracked as CVE-2026-95114 and has a high severity rating. A patch is available in version 4.3.3-9.oe2403sp1 to address this issue.