Threat database

A security update for libpng12 addresses two use-after-free vulnerabilities in functions png_set_tRNS, png_set_PLTE, and png_set_hIST. These flaws can lead to arbitrary code execution or heap information disclosure. The update advances libpng12 to version 1.2.59 to fix these issues.

Multiple security issues were fixed in the postfix-3.11.2-1.1 package on the GA media of openSUSE Tumbleweed. The details of these issues are not specified in the provided data.

A security update for libsoup has been released by the SUSE Product Security Team. This update provides a functional equivalent of the Red Hat advisory RHSA-2026:14087. No specific technical details or affected versions are provided in the available information.

Multiple security issues were addressed in the gnutls-3.8.13-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by several CVEs. No specific details about the nature of the vulnerabilities or their impact are provided.

A security update for the libtiff library addresses a vulnerability identified as CVE-2026-4775. This update is functionally equivalent to the Red Hat advisory RHSA-2026:12271. No specific technical details or affected versions are provided in the available data.

This vulnerability concerns a regression issue in python-urllib3 addressed by the update for CVE-2025-66471. The update fixes a regression introduced in the previous patch. No detailed technical or impact information is provided beyond this fix.

A security update for giflib addresses CVE-2026-23868, which involves a double-free vulnerability caused by a shallow copy operation that can lead to memory corruption.

An LDAP injection vulnerability (CVE-2026-0636) exists in the Legion of the Bouncy Castle Inc. BC-JAVA bcprov library, specifically in the LDAPStoreHelper program files. This flaw affects versions 1.74 through 1.80.1, 1.81, and 1.82 through 1.83. The vulnerability allows improper neutralization of special elements in LDAP queries. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 base score is 6.5, indicating a medium severity impact with potential confidentiality and integrity loss but no availability impact. Red Hat has issued security advisories with patches available for affected products.

A covert timing channel vulnerability exists in the Bouncy Castle BC-JAVA core library affecting the FrodoKEM algorithm during decryption. This flaw arises from non-constant time comparisons that may leak private keys. Versions from 1.71 up to but not including 1.80.2, 1.81 up to but not including 1.81.1, and 1.82 up to but not including 1.84 are affected. The vulnerability allows an unauthenticated remote attacker to send malformed ciphertexts and perform statistical timing analysis to potentially recover private keys. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 score is 7.5 (high severity).