Multiple security issues were fixed in the chromedriver-156.0.8078.79-1.1 package on the GA media of openSUSE Tumbleweed. The vulnerabilities are addressed by this updated package version. No specific details about the nature or impact of these issues are provided.
Multiple security issues were fixed in the busybox-1.38.0-4.1 package included in the GA media of openSUSE Tumbleweed. These issues affect the SUSE product and were addressed by the SUSE Product Security Team. No specific affected versions or detailed vulnerability descriptions are provided.
This security update for the SUSE Linux Enterprise Kernel 4.12.14-122.283 addresses multiple security vulnerabilities affecting various kernel components including crypto, xfrm, sctp, ipvs, SUNRPC, nfsd, and ipv4. The update fixes issues such as improper handling of initialization vectors, stale pointers after asynchronous crypto operations, transport count overflow, improper clearing of IPv4 options, error path bugs, buffer length underflows, incorrect XDR length calculations, and freeing of options after RCU grace periods.
This security update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.75 addresses multiple security vulnerabilities including issues in SCTP, SUNRPC, NFS daemon, and IPv4 components. The fixes prevent potential overflow, error path bugs, buffer underflow, incorrect length calculations, and improper resource freeing after RCU grace periods.
This security update for nodejs22 addresses multiple vulnerabilities including remote code execution via a Brotli decoder out-of-bounds write, TLS certificate hostname bypasses, permission model bypass, and issues with entropy caching in cryptographic functions. The update includes several dependency upgrades and fixes for these security flaws.
A security update for GnuTLS addresses CVE-2025-14831, which involves excessive resource consumption during verification of malicious certificates with many name constraints and subject alternative names. This vulnerability could lead to denial of service conditions due to resource exhaustion.
This security update for OpenSSH addresses multiple vulnerabilities including unauthorized file location changes by malicious SFTP servers, improper file writes by SCP servers, silent truncation of internal-sftp command arguments, security impacts related to GSSAPIStrictAcceptorCheck in Windows Active Directory, incorrect override behavior between DisableForwarding and PermitTunnel settings, a pre-authentication denial of service when GSSAPIAuthentication is enabled, enforcement of minimum authentication delay, and a client-side use-after-free during host key changes in key reexchange.
pypdf versions prior to 6.21.3 have a vulnerability where accessing the page count of a crafted encrypted PDF can cause excessive time and memory consumption. This occurs because the page count retrieval trusts an attacker-controlled forged /Count value in the page tree without validation. The issue is fixed in version 6.21.3.
pypdf versions prior to 6.21.3 have a vulnerability where loading a crafted invalid PDF dictionary in strict mode can cause excessive memory consumption. This occurs because nested parsing failures append repeated exception text to newly raised errors, amplifying small malformed dictionaries into very large error messages. The issue is fixed in version 6.21.3.
pypdf versions prior to 6.21.3 have a performance issue when retrieving page labels from crafted PDFs with a flat page-label number tree containing many ranges. The page_labels property repeatedly scans the same /Nums array from the beginning for each page, causing excessive processing time that grows with the number of pages and label ranges. This can lead to denial of service due to high resource consumption. The issue is fixed in version 6.21.3.
pypdf versions prior to 6.21.4 contain a vulnerability where cloning or duplicating a crafted cyclic DictionaryObject can cause the library to enter an infinite loop. This occurs because the clone traversal checks generated destination references instead of the original source references, allowing some cyclic references to bypass the visited-object check. The issue is resolved in version 6.21.4.
pypdf versions prior to 6.21.4 have a vulnerability where parsing a crafted PDF page tree with many shared resources can cause excessive memory consumption. This occurs because page-tree flattening copies page dictionary and inherited resource entries without limiting the total document-wide entries, leading to disproportionate memory allocations. The issue is fixed in version 6.21.4.
pypdf versions prior to 6.21.4 can enter an infinite loop when opening a specially crafted incomplete PDF file. The issue occurs if the PDF's standard cross-reference table reaches the end of the file without a trailer, causing the parser to repeatedly rewind to the same position and block processing. This flaw is fixed in version 6.21.4.
ImageMagick versions before 7.1.2-34 contain a stack overflow vulnerability in the TIFF decoder that can be triggered when the DNG decoder is disabled. An attacker can supply a crafted image file to cause a stack overflow, resulting in application crash and denial of service.
A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. An integer handling flaw in the decompression logic can be exploited by a remote attacker supplying a specially crafted compressed stream, causing an out-of-bounds read and an unhandled panic that crashes the application, resulting in a denial of service (DoS). The issue affects applications decompressing untrusted inputs using this library. No direct configuration workaround exists within the library itself. Mitigations include rejecting or filtering untrusted zstd-compressed payloads at ingress or restricting decompression to trusted clients. A fixed version is available in klauspost/compress 1.20.2 and corresponding Red Hat builds.
A security update for the Brotli compression library addresses a vulnerability identified as CVE-2026-111497. This flaw involves an out-of-bounds write in the Brotli decoder, which could allow remote code execution. The issue was reported by the SUSE Product Security Team and is classified as high severity. No specific affected versions or patch details are provided in the available data.
Multiple security vulnerabilities have been identified and fixed in libsoup, including issues leading to credential leaks, out-of-bounds reads, heap buffer overflows, denial of service via protocol violations, and HTTP request smuggling. These flaws affect various components such as proxy authorization headers, multipart body parsing, WebSocket handling, HTTP/2 frame parsing, and multipart input stream processing.
This security update for the google-guest-agent addresses multiple vulnerabilities in the golang.org/x/net/http2 package, including memory exhaustion, acceptance of malformed headers, double flow control refunds, excessive CPU consumption, and server crashes due to race conditions. The update includes upgrading dependencies and various fixes. No specific affected versions are stated.
libexpat versions through 2.9.0 have a signed integer overflow vulnerability in the storeAtts() function within lib/xmlparse.c. This flaw allows attackers to cause out-of-bounds writes by supplying XML documents with an excessively large number of attributes (over 2^30) in a start tag. Exploitation can lead to application crashes or heap memory corruption.