Threat database

Multiple security issues were addressed in the gnutls-3.8.13-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by several CVEs. No specific details about the nature of the vulnerabilities or their impact are provided.

A security update for the libtiff library addresses a vulnerability identified as CVE-2026-4775. This update is functionally equivalent to the Red Hat advisory RHSA-2026:12271. No specific technical details or affected versions are provided in the available data.

This vulnerability concerns a regression issue in python-urllib3 addressed by the update for CVE-2025-66471. The update fixes a regression introduced in the previous patch. No detailed technical or impact information is provided beyond this fix.

Multiple security issues have been fixed in the libpng12-0 package version 1.2.59-5.1 on the GA media of openSUSE Tumbleweed. These vulnerabilities affect the SUSE distribution and have been addressed in this specific package update.

A security update for giflib addresses CVE-2026-23868, which involves a double-free vulnerability caused by a shallow copy operation that can lead to memory corruption.

An LDAP injection vulnerability (CVE-2026-0636) exists in the Legion of the Bouncy Castle Inc. BC-JAVA bcprov library, specifically in the LDAPStoreHelper program files. This flaw affects versions 1.74 through 1.80.1, 1.81, and 1.82 through 1.83. The vulnerability allows improper neutralization of special elements in LDAP queries. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 base score is 6.5, indicating a medium severity impact with potential confidentiality and integrity loss but no availability impact. Red Hat has issued security advisories with patches available for affected products.

A covert timing channel vulnerability exists in the Bouncy Castle BC-JAVA core library affecting the FrodoKEM algorithm during decryption. This flaw arises from non-constant time comparisons that may leak private keys. Versions from 1.71 up to but not including 1.80.2, 1.81 up to but not including 1.81.1, and 1.82 up to but not including 1.84 are affected. The vulnerability allows an unauthenticated remote attacker to send malformed ciphertexts and perform statistical timing analysis to potentially recover private keys. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 score is 7.5 (high severity).

This security update for python-urllib3 addresses multiple resource exhaustion vulnerabilities related to decompression processes. The issues include unbounded decompression chains, excessive resource consumption from highly compressed data in the Streaming API, and during decompression of HTTP redirect responses. Additionally, a non-security issue disables response decompression with brotli due to a missing feature.