Threat database

This security update for glibc addresses three vulnerabilities: CVE-2026-4046, which can cause an assertion failure leading to remote application crashes; CVE-2026-5450, a heap overflow triggered by the scanf %mc pattern with width greater than 1024; and CVE-2026-5928, where ungetwc may leak data under special conditions.

A security update for the TIFF library addresses a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function. This flaw is identified as CVE-2026-4775 and has been assigned a high severity rating by the SUSE Product Security Team.

A vulnerability in GStreamer gst-plugins-good before version 1.28.2 allows insufficient validation of MP4 audio track atom data in the isomp4 plugin. This leads to an integer division by zero error in the qtdemux_parse_trak function, causing a denial of service (DoS) by crashing the plugin. The issue affects multiple Ubuntu package versions and has been fixed in updated releases.

Multiple security issues have been fixed in the glibc-2.43-3.1 package included in the GA media of openSUSE Tumbleweed. These fixes address vulnerabilities present in earlier versions of glibc used by SUSE. No specific details on the nature of the vulnerabilities or their impact are provided.

A vulnerability in Next.js App Router applications allows middleware or proxy bypass via segment-prefetch routes. This issue is an incomplete fix of CVE-2026-44575, specifically affecting middleware.ts when used with Turbopack. The vulnerability can lead to information disclosure due to middleware bypass. It affects Next.js versions from 15.2.0 up to but not including 15.5.18, and from 16.0.0 up to but not including 16.2.6. A patch is available in versions 15.5.18 and 16.2.6.

Multiple security vulnerabilities have been identified and fixed in the nginx 1.26 module for Red Hat Enterprise Linux 9.6. These include denial of service and potential code execution via specially crafted MP4 files, buffer overflow leading to denial of service or file modification in the ngx_http_dav_module, memory corruption causing denial of service via crafted MP4 files, and denial of service via undisclosed requests when the ngx_mail_auth_http_module is enabled. The update addresses these issues to improve the security of nginx deployments on affected Red Hat platforms.

Pillow versions from 4.2.0 up to but not including 12.2.0 contain a vulnerability where processing a maliciously crafted PDF can cause the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This denial of service issue has been addressed in version 12.2.0. The vulnerability affects multiple Ubuntu package versions and has a medium severity rating with a CVSS score of 5.5.

VM2 versions prior to 3.11.2 contain a sandbox escape vulnerability that allows attackers to execute arbitrary code on the host system by breaking the VM2 sandbox isolation. The flaw arises from improper handling of exceptions with null prototype objects, enabling attackers to access host functions and execute commands. This vulnerability is rated critical with a CVSS score of 9.8 and has been fixed in version 3.11.2.

VM2 versions prior to 3.11.2 contain a critical sandbox escape vulnerability via the neutralizeArraySpeciesBatch method. This flaw allows attackers to invoke host-side getters on array prototypes, exposing host objects including the host Function object, enabling arbitrary code execution on the host system. The vulnerability is fixed in version 3.11.2.

This entry concerns security updates addressing vulnerabilities identified as CVE-2026-43284 and CVE-2026-43500 in SUSE products. Public exploit code is available for CVE-2026-43284 via Metasploit and Exploit-DB, indicating the vulnerability is well-documented and potentially exploitable. No specific affected versions or detailed impact descriptions are provided. The severity is noted as high, but no CVSS score is available.

A vulnerability in the vm2 library's NodeVM with the option nesting: true allows sandboxed code to bypass require restrictions and load the vm2 module itself. This enables the creation of an inner NodeVM with unrestricted require capabilities, allowing execution of arbitrary OS commands on the host. The issue arises because nesting: true injects vm2 into the sandbox's builtins unconditionally, overriding require: false or any allowlist. This flaw affects all vm2 versions prior to 3.11.1.