Threat database

Multiple security issues were fixed in the libpng16-16-1.6.56-1.1 package included in the GA media of openSUSE Tumbleweed. The details of these issues are not specified in the provided data.

Traefik's Basic and Digest authentication middlewares are vulnerable to identity spoofing when the 'headerField' is configured with a non-canonical HTTP header name. An authenticated attacker with valid credentials can inject a canonical header version to impersonate any user identity to backend services. This occurs because Traefik writes the authenticated username using a non-canonical header key, creating a separate header entry that does not overwrite the attacker-injected canonical header. The vulnerability enables privilege escalation if backends rely on this header for authorization decisions. Patches fixing this issue are available in Traefik versions 2.11.42, 3.6.12, and 3.7.0-ea.3.

NLTK's downloader component suffers from a path traversal vulnerability due to improper validation of XML index attributes. This flaw allows an attacker controlling a remote XML index server to specify malicious paths with traversal sequences, leading to arbitrary directory creation and file overwrite on the victim's file system, including critical system files. The vulnerability affects NLTK versions prior to 3.9.4. A patch is available in version 3.9.4.

This security update for libpng16 addresses multiple vulnerabilities including a heap buffer overflow (CVE-2026-25646) and memory leaks (CVE-2025-28162 and CVE-2025-28164) related to the png_set_dither/png_set_quantize functions and the pngimage utility. These issues were fixed by the SUSE Product Security Team.

Multiple security issues were addressed in the giflib-devel-32bit-5.2.2-3.1 package on the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities present in prior versions of this package.

NLTK versions up to and including 3.9.2 contain a path traversal vulnerability in multiple CorpusReader classes, allowing attackers to read arbitrary files on the server. This occurs due to improper sanitization of file paths in classes such as WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. Exploitation can lead to unauthorized access to sensitive files and potentially escalate to remote code execution when combined with other vulnerabilities. A fix is available in version 3.9.3.

This security update for python-urllib3 addresses multiple vulnerabilities related to excessive resource consumption and resource exhaustion during data decompression in various scenarios, including the Streaming API, decompression chains, and HTTP redirect responses.

A security update for libpng12 addresses a heap buffer overflow vulnerability in the png_set_dither and png_set_quantize functions. This flaw is identified as CVE-2026-25646 and was reported by the SUSE Product Security Team. The vulnerability could lead to memory corruption issues if exploited.

Apache Tomcat and Tomcat Native contain an improper input validation vulnerability in their OCSP response handling. This flaw allows bypassing certificate revocation checks because Tomcat Native and Tomcat's FFM port did not complete verification or freshness checks on OCSP responses. The vulnerability affects multiple versions of Apache Tomcat Native and Apache Tomcat. Fixed versions have been released to address this issue.