Threat database

A security update for SUSE's openssl-1_1-livepatches addresses CVE-2026-84782, which involves DTLS retransmitting handshake messages from a stale buffer offset. This vulnerability has been assigned a high severity rating. No specific affected versions are provided in the data. No public exploit or CVSS score is available.

This security update for OpenSSL 1.1 addresses multiple vulnerabilities including excessive memory allocation, timing side-channel attacks on elliptic curve operations, denial of service via undersized DTLS 1.2 AEAD records, and DTLS handshake retransmission issues. These flaws could lead to memory exhaustion, information leakage through timing analysis, and denial of service conditions. The update also includes a compiler flag addition to prevent certain optimization issues.

This security update for psqlODBC addresses multiple vulnerabilities including denial of service, buffer overflows, SQL injection, and improper validation of server-supplied data. The update includes fixes for integer wraparound in SQLBindParameter, large-object read overflows, stack buffer overflows, SQL injection via SQLSpecialColumns, and issues with log file permissions. Several hardening improvements and bug fixes are also included in the updated versions.

The bsv-rs library's Signature::from_der function leniently parses DER-encoded ECDSA signatures, allowing signatures with extra trailing bytes, incorrect sequence lengths, or unnecessary leading zeros in R or S values. This leniency causes multiple distinct byte strings to verify as the same signature over the same data, potentially impacting applications that compare, hash, or store signature bytes. The issue is fixed in versions 0.8.6 and 0.9.0-beta.7.0, which reject these malformed signatures. However, signature byte uniqueness is not fully guaranteed due to the nature of ECDSA's low-S normalization.

The bsv-rs library's Transaction::from_json method improperly handles input transaction IDs (txid) that are not exactly 64 hexadecimal digits. When such invalid txids are parsed, the method returns Ok but internally treats the input as spending a zeroed-out txid, causing inconsistent transaction identification. This affects applications that parse peer transaction documents and rely on both textual and binary representations of inputs. Versions prior to 0.8.6 and certain beta versions before 0.9.0-beta.7.0 are affected. The issue is fixed in versions 0.8.6 and 0.9.0-beta.7.0.

A security update for perl-Net-DNS addresses CVE-2026-81928, a vulnerability involving memory exhaustion caused by unbounded recursion in the sig_data function when re-encoding a message containing a misplaced TSIG record.

This advisory addresses a bug fix and enhancement update to the oci-delta tool used in Red Hat Enterprise Linux 9. The oci-delta utility creates and applies delta files between OCI image archives, optimizing storage by excluding layers already present and using binary diffs for changed layers. The update to version 0.3.1 resolves issues tracked under JIRA RHEL-294259 and includes fixes related to CVE-2026-33818 and CVE-2026-97031.

Multiple security issues were addressed in the xwayland-24.1.14-2.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of the xwayland component.

Multiple security issues were fixed in the xorg-x11-server-21.1.25-2.1 package for openSUSE Tumbleweed. These vulnerabilities affect the X.Org X11 server component distributed by SUSE. No specific details about the nature or impact of the individual issues are provided.

Multiple security issues have been fixed in the python313-joserfc-1.7.7-2.1 package included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities addressed are not detailed in the provided information.

Multiple security issues affecting the pdns-recursor package were fixed in version 5.4.8-1.1 on the GA media of openSUSE Tumbleweed. The vulnerabilities are collectively addressed by this package update. No specific details about the nature of the vulnerabilities or their impact are provided.

Multiple security issues were fixed in the mcp-server-everything-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed. The details pertain to the SUSE product security team addressing vulnerabilities in this package version. No specific vulnerabilities or affected versions are detailed beyond this package update.

Multiple security issues were addressed in the gopass-1.17.4-2.1 package included in the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities present in prior versions of the gopass package.

Multiple security issues have been fixed in the go1.26-1.26.11-1.1 package on the GA media of openSUSE Tumbleweed. These issues affect the SUSE product and were addressed by the SUSE Product Security Team. No specific details about the vulnerabilities or their impact are provided.

Multiple security issues were addressed in the ghostscript-10.08.0-5.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in earlier versions of the Ghostscript software distributed by SUSE. No specific details about the nature of the vulnerabilities or their impact are provided.

The firefox-esr-153.7.0-1.1 package on the GA media of openSUSE Tumbleweed addresses multiple security issues. These issues have been fixed in this package version. No specific vulnerabilities or impacts are detailed in the provided information.

Multiple security issues were fixed in the distribution-registry-3.1.2-6.1 package included in the GA media of openSUSE Tumbleweed. No specific details about the vulnerabilities or their impacts are provided.

Multiple security issues were addressed in the cherrytree-1.7.3-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in the prior versions of the package.

Multiple security issues were addressed in the apache-commons-codec package version 1.23.0-1.1 included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities are identified under CVE-2026-119078 and CVE-2026-124077. No detailed technical information or CVSS scores are provided for these issues.