Threat database

Netpbm versions before 10.86.51, 11.02.30, and 11.15.08 contain an integer overflow vulnerability in the winicontopam component. This flaw allows attackers to supply crafted icon files with dimensions exceeding 32767, causing integer overflow in int16_t loop counters. The overflow leads to negative row buffer indices, enabling heap memory corruption that can result in application crashes or potential code execution.

Netpbm versions before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contain a heap-based buffer overflow vulnerability in the sgitopnm tool's readChannels() function. This occurs when processing RLE-compressed SGI images with crafted files that have oversized offset table lengths. Exploitation can lead to crashes or potential code execution.

inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.

This security update for cadvisor addresses two vulnerabilities: CVE-2026-116591, which involves a crafted zstd frame causing decoder panic, and CVE-2026-78663, related to a double flow control refund on HTTP/2 server streams. Both issues could lead to denial of service conditions. The update fixes these issues by updating the vendor.tar component.

An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.

A vulnerability in Apache Arrow Rust's RunEndEncoded arrays allows out-of-bounds reads due to improper validation of array data. This flaw occurs when reading the last value via certain APIs, potentially exposing memory beyond the intended bounds. The issue has been fixed in versions 57.3.2, 58.4.1, 59.3.2, and 60.1.0 by improving validation of RunEndEncoded array contents.

This security update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 addresses multiple security vulnerabilities affecting various kernel subsystems including crypto, IPv6, block device handling, network filesystem, and others. The update fixes issues such as infinite loops, heap overflows, buffer overruns, and other memory corruption bugs. These vulnerabilities have been assigned CVE identifiers and are resolved in this kernel update.

This security update for the SUSE Linux Enterprise Kernel 6.12.0-160000.33.1 addresses multiple security vulnerabilities affecting various kernel components including virtiofs, IPv6, block device handling, network file systems, crypto processing, SCTP, IPVS, AF_UNIX, XFS, SUNRPC, NFS, and IPv4. The update fixes issues such as use-after-free, infinite loops, heap overflows, buffer overruns, and other memory corruption bugs.