Multiple security vulnerabilities affecting the Real Time Linux Kernel (kernel-rt) packages in Red Hat Enterprise Linux 8 have been addressed in an important security update. The update fixes several use-after-free issues, denial of service vulnerabilities, and other kernel bugs that could impact system stability and security. A reboot is required to apply the update. Red Hat strongly recommends applying these fixes promptly to maintain system security.
Two security vulnerabilities have been identified in the python-urllib3 library used in Red Hat Enterprise Linux 9.6 Extended Update Support. The first vulnerability (CVE-2026-97689) allows denial of service via unbounded memory allocation in the chunk parser. The second vulnerability (CVE-2026-97687) enables traffic interception through HTTPS proxy TLS configuration override. Red Hat has issued an important security advisory with updated python-urllib3 packages to address these issues.
A security vulnerability (CVE-2026-97417) has been identified in the Linux kernel's netfilter nf_conntrack component, specifically in the tcp_sack() function. This flaw involves improper handling of unaligned data, addressed by using get_unaligned_be32(). Red Hat has released a kernel security update for Red Hat Enterprise Linux 6 Extended Lifecycle Support to fix this issue. The update requires a system reboot to take effect. Red Hat rates this update as important for security and advises prompt application of the patch to maintain system security.
A security update for OpenSSL addresses a vulnerability identified as CVE-2026-84782 affecting the compat-openssl component. The flaw involves DTLS retransmitting handshake messages from a stale buffer offset. This issue is rated as having an important security impact by Red Hat and affects Red Hat Enterprise Linux Server Extended Life Cycle Support Extension 6. A patch is available in the updated OpenSSL packages provided by Red Hat.
Multiple critical vulnerabilities have been identified in the python-pillow library used in Red Hat Enterprise Linux 8.6. These include heap buffer overflows, denial of service conditions via various memory and recursion issues, and an argument injection vulnerability potentially leading to remote code execution. The vulnerabilities affect image processing functions such as TIFF saving, PDF parsing, JPEG decoding, and image transformations. Red Hat has issued a security update addressing these issues.
Red Hat OpenShift Container Platform 4.17.60 includes multiple critical security fixes addressing vulnerabilities in kernel components, OpenSSH, OpenSSL, PCRE2, and other libraries. These fixes resolve issues such as use-after-free, out-of-bounds writes, security bypasses, and certificate distrust. Users of OpenShift Container Platform 4.17 are advised to upgrade to this release to mitigate these critical vulnerabilities.
Red Hat issued a security advisory for golang-github-openprinting-ipp-usb addressing multiple vulnerabilities in Go packages used by the IPP-over-USB HTTP reverse proxy. The vulnerabilities include denial of service, certificate validation bypass, privilege escalation, and denial of service via various malformed inputs affecting crypto/x509, net, mime, encoding/asn1, net/url, net/http, crypto/tls, and encoding/xml packages. These issues impact Red Hat Enterprise Linux 10.0 Extended Update Support and related architectures. The advisory rates the security impact as Important and provides updated packages to remediate the issues.
Multiple security vulnerabilities have been identified and fixed in the dnsmasq packages used in Red Hat Enterprise Linux 8.4. These include heap buffer overflows, infinite loops, out-of-bounds reads, and source validation bypasses affecting DNS and DHCP functionalities. An update addressing these issues is available.
Multiple security vulnerabilities have been identified in Flatpak, a system for building and running sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary root write access via extra-data extraction, a buffer overflow on 32-bit systems, and local privilege escalation via symlink traversal. Red Hat has issued a security update addressing these issues in Flatpak packages for Red Hat Enterprise Linux 8.4. Users are advised to apply the update to mitigate these vulnerabilities.
The npm package 'yummy-bolts' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
Microsoft's November 2026 Patch Tuesday addresses 1095 vulnerabilities across multiple products, including 64 critical issues. Among these, 48 are remote code execution vulnerabilities. One vulnerability, CVE-2026-124194 in Microsoft Office Outlook, has been exploited in the wild and involves spoofing due to lack of UI warnings for unsafe actions. Several high-severity remote code execution and elevation of privilege vulnerabilities affect Windows components, Active Directory, Microsoft Exchange Server, and Microsoft Office applications. Microsoft highlights certain vulnerabilities as more likely to be exploited, including CVE-2026-113862 (Windows NAT), CVE-2026-118146 and CVE-2026-118148 (Active Directory), CVE-2026-118207 (Exchange Server), and CVE-2026-119952 (Windows Schannel).
The npm package @fadelsm/libsignal-node contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a different, trusted device. Removing the package does not guarantee removal of all malicious software introduced by it.
This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 9. The update includes fixes for numerous security issues such as NULL pointer dereferences, use-after-free conditions, out-of-bounds writes, memory corruption, and denial of service vulnerabilities across various kernel subsystems including networking, USB, Bluetooth, RDMA, and virtualization. The advisory emphasizes the importance of applying the update and rebooting the system to mitigate these issues.
The npm package pt-logger-telemetry-eax0x1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
Viber for iOS versions up to 29.4.0.24 contain a vulnerability where the app does not properly validate the logical screen width and height in GIF headers. An attacker can send a specially crafted GIF with zero dimensions that causes the app to crash due to an uncaught exception.