Threat database

A security update for the libtiff library addresses a vulnerability identified as CVE-2026-4775. This update is functionally equivalent to the Red Hat advisory RHSA-2026:12271. No specific technical details or affected versions are provided in the available data.

This vulnerability concerns a regression issue in python-urllib3 addressed by the update for CVE-2025-66471. The update fixes a regression introduced in the previous patch. No detailed technical or impact information is provided beyond this fix.

Multiple security issues have been fixed in the libpng12-0 package version 1.2.59-5.1 on the GA media of openSUSE Tumbleweed. These vulnerabilities affect the SUSE distribution and have been addressed in this specific package update.

A security update for giflib addresses CVE-2026-23868, which involves a double-free vulnerability caused by a shallow copy operation that can lead to memory corruption.

An LDAP injection vulnerability (CVE-2026-0636) exists in the Legion of the Bouncy Castle Inc. BC-JAVA bcprov library, specifically in the LDAPStoreHelper program files. This flaw affects versions 1.74 through 1.80.1, 1.81, and 1.82 through 1.83. The vulnerability allows improper neutralization of special elements in LDAP queries. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 base score is 6.5, indicating a medium severity impact with potential confidentiality and integrity loss but no availability impact. Red Hat has issued security advisories with patches available for affected products.

A covert timing channel vulnerability exists in the Bouncy Castle BC-JAVA core library affecting the FrodoKEM algorithm during decryption. This flaw arises from non-constant time comparisons that may leak private keys. Versions from 1.71 up to but not including 1.80.2, 1.81 up to but not including 1.81.1, and 1.82 up to but not including 1.84 are affected. The vulnerability allows an unauthenticated remote attacker to send malformed ciphertexts and perform statistical timing analysis to potentially recover private keys. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 score is 7.5 (high severity).

This security update for python-urllib3 addresses multiple resource exhaustion vulnerabilities related to decompression processes. The issues include unbounded decompression chains, excessive resource consumption from highly compressed data in the Streaming API, and during decompression of HTTP redirect responses. Additionally, a non-security issue disables response decompression with brotli due to a missing feature.

A buffer overflow vulnerability exists in the cryptography library when non-contiguous Python buffers are passed to certain APIs such as Hash.update(). This flaw affects versions from 45.0.0 up to but not including 46.0.7 and can cause reading past the end of the buffer in Python versions greater than 3.11. The vulnerability has a critical severity with a CVSS score of 9.8. A patch is available in version 46.0.7.