This security update for Chromium addresses multiple critical vulnerabilities including use-after-free bugs, heap buffer overflows, out-of-bounds reads and writes, insufficient validation of untrusted input, race conditions, and incorrect security UI. The vulnerabilities affect various Chromium components such as WebShare, Digital Credentials, WebView, WebRTC, GPU, Extensions, and Passwords. The update fixes issues in Chromium versions 149.0.7827.102, 149.0.7827.114, and 149.0.7827.155. These vulnerabilities could lead to memory corruption and potential security breaches if exploited.
A security update for Chromium addresses multiple critical vulnerabilities including out of bounds reads and writes, use after free, integer overflows, heap buffer overflows, uninitialized use, and insufficient validation of untrusted input in various components. These vulnerabilities could allow attackers to cause memory corruption or execute arbitrary code. The update fixes these issues in Chromium version 148.0.7778.215.
Multiple critical security vulnerabilities affecting Chromium have been addressed in updates culminating in version 146.0.7680.177. These vulnerabilities include use-after-free, heap buffer overflows, integer overflows, out-of-bounds reads and writes, insufficient policy enforcement, and incorrect security UI implementations across various components such as CSS, GPU, WebGL, V8, WebCodecs, Dawn, PDF, WebAudio, and WebRTC. The issues have been fixed in Chromium version 146.0.7680.177.
This security update for Chromium addresses multiple critical vulnerabilities including use-after-free bugs, heap buffer overflows, integer overflows, type confusion, insufficient validation of untrusted input, race conditions, and policy enforcement issues. The vulnerabilities affect various components such as Canvas, iOS, Accessibility, GPU, ANGLE, Skia, Media, WebRTC, V8, PDFium, and Blink. These issues could lead to memory corruption, information leakage, or bypass of security policies. The update covers several Chromium versions including 147.0.7727.55, 147.0.7727.101, 147.0.7727.116, and 147.0.7727.137. The vulnerabilities have been fixed in this update, and no known exploits are reported in the wild.
Multiple security vulnerabilities have been identified and fixed in Chromium versions prior to 144.0.7559.132. These vulnerabilities include heap buffer overflow, type confusion, race conditions, out-of-bounds memory access, use-after-free, and incorrect security UI implementations. The flaws could lead to remote code execution and memory corruption when processing crafted web content. A security update addressing these issues is available.
A security update for Chromium addresses multiple vulnerabilities including integer overflows, heap buffer overflows, use-after-free issues, and inappropriate implementations in various components such as ANGLE, PowerVR, Skia, DevTools, WebAudio, CSS, WebAssembly, V8, WebCodecs, Media, PDFium, and WebGPU. The affected versions range from 145.0.7632.45 through 145.0.7632.159. These vulnerabilities have been assigned CVE identifiers from CVE-2026-2313 to CVE-2026-3545. The update also includes packaging and build improvements. No explicit patch links or vendor advisory details were provided.
This security update for Chromium addresses multiple vulnerabilities across several versions, including issues such as use-after-free, out-of-bounds memory access, type confusion, and insufficient policy enforcement. The vulnerabilities affect components like WebView, WebGPU, V8 JavaScript engine, ANGLE, Password Manager, Toolbar, Google Updater, DevTools, Digital Credentials, Downloads, Loader, Media Stream, WebRTC, and Passwords. One of the issues fixed in version 143.0.7499.109 is known to have an exploit in the wild. The update includes fixes for CVE-2025-13630 and numerous other CVEs, improving overall security posture. No CVSS scores are provided for these vulnerabilities. The affected versions are not explicitly stated in the input data.
A security update for libgpg-error addresses an out-of-bounds read vulnerability in the _gpgrt_vfnameconcat function within stringutils.c when the GPGRT_FCONCAT_SYSCONF flag is used. This flaw could potentially lead to memory access issues. The severity is assessed as medium. No specific affected versions or CVSS score are provided. No known exploits in the wild have been reported.
A security update for libgpg-error addresses an out-of-bounds read vulnerability in the _gpgrt_vfnameconcat function within stringutils.c when the GPGRT_FCONCAT_SYSCONF flag is used. This issue could potentially lead to memory safety problems. The vulnerability is rated medium severity. No specific affected versions or CVSS score are provided.
A security update for libgpg-error addresses an out-of-bounds read vulnerability in the _gpgrt_vfnameconcat function within stringutils.c when the GPGRT_FCONCAT_SYSCONF flag is used. This issue could potentially lead to memory safety problems. The vulnerability is rated medium severity. No specific affected versions or patch details are provided in the available data.
Multiple security issues have been addressed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by various CVEs. The overall severity of these issues is assessed as medium. No specific affected versions are detailed beyond the fixed package version. There is no CVSS score available for these vulnerabilities. No known exploits are reported in the wild for these issues.
A reflected cross-site scripting (XSS) vulnerability (CVE-2026-15928) exists in the error page component of the xmlrpc-c library. This vulnerability affects xmlrpc-c versions from 9.0 up to but not including 9.8. Red Hat has released a security update for Red Hat Enterprise Linux 9 and related products to address this issue.
Two security vulnerabilities have been identified in the X.Org X11 libXfont2 runtime library affecting Red Hat Enterprise Linux 9 and related variants. These include an out-of-bounds read/write in the Font Server Client encoding (CVE-2026-59679) and a privilege escalation via a heap buffer overflow in the Font Server Client (CVE-2026-44950). Red Hat has released security updates addressing these issues. The vulnerabilities are rated as having an important security impact by Red Hat Product Security.
A buffer overflow vulnerability exists in GNU C Library (glibc) versions 2.38 to 2.44 when calling strfmon or strfmon_l with right-justified width padding. This can cause writes past the end of the caller-supplied output buffer. Exploitation requires specific application code paths and conditions. At the time of the advisory, no network-facing impact is known. Red Hat has issued a security update addressing this issue in their Hardened Images RPMs.
A local privilege escalation vulnerability (CVE-2026-7867) exists in udisks2 due to insufficient authorization checks on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This flaw affects certain versions of SUSE and Red Hat Enterprise Linux 10. Red Hat has released a security update to address this issue.
Multiple vulnerabilities have been identified and fixed in the gstreamer-devtools package by the SUSE Product Security Team. These include a race condition causing double-free and memory corruption, terminal manipulation via ANSI escape sequences, integer overflow leading to crashes, stack exhaustion from date parsing, process crashes from empty Range headers, and information disclosure from non-existing folder arguments. The issues affect versions prior to 1.26.7-160000.2.1. The severity of these combined issues is high.
This security update for python-cryptography addresses three vulnerabilities: CVE-2026-69247, involving a Bleichenbacher oracle exposure via PKCS#7 EnvelopedData decryption errors and timing; CVE-2026-69248, where the verifier improperly accepts wildcard DNS names allowing escape from permittedSubtrees; and CVE-2026-69249, where duplicate self-signed intermediates can cause exponential path-building. These vulnerabilities affect certain versions of python-cryptography in SUSE products. A patch is available to remediate these issues.
A vulnerability in librest's PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator (PRNG). This flaw allows attackers who can intercept the authorization code to reverse-engineer the PRNG seed, predict or reconstruct the code verifier string, and impersonate the client during the OAuth 2.0 authorization flow. The vulnerability has been rated with important severity and affects certain versions of librest. A security update is available to address this issue.
Multiple vulnerabilities in dhcpcd affecting DHCPv6 and related components have been addressed in version 10.5.0. These include denial of service, stack out-of-bounds write, memory leak, and heap use-after-free issues. The vulnerabilities can be triggered by crafted DHCPv6 messages and privileged commands, potentially causing service disruption or memory corruption. The update to version 10.5.0 includes these security fixes along with code improvements and new features.