This update for python-joserfc fixes the following issues:
Changes in python-joserfc:
- CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT
malleability and allows for bypass of token revocation and anti-replay
protection (bsc#1272991)
A use-after-free vulnerability (CVE-2026-12610) exists in the System Security Services Daemon (SSSD) PAM responder, triggered when a cancelled or completed PAM request occurs while an asynchronous child process is still running. This can cause SSSD to crash, particularly when interacting with smartcards or Yubikeys. The issue affects multiple versions of SSSD across various Ubuntu and SUSE releases. A security update is available that addresses this vulnerability, and a system restart of SSSD is required after applying the update.
Two security vulnerabilities in spice-vdagent have been addressed. CVE-2026-57965 is an integer overflow in the udscs_write() function that can cause the spice-vdagent daemon to crash via a heap buffer overflow triggered by a malicious SPICE host message. CVE-2026-57966 involves improper sanitization that allows a compromised SPICE host to write arbitrary files anywhere on the guest OS. Both vulnerabilities require a compromised SPICE host to exploit.
This security update for perl-Date-Manip addresses two vulnerabilities: CVE-2026-60074, which causes corrupted dates when processing non-ASCII decimal digits that pass numeric range checks, and CVE-2026-60075, which leads to CPU exhaustion due to quadratic backtracking in time substitution parsing. Both issues can affect the correctness and performance of date processing in the affected software.
Multiple security issues were addressed in the evince-48.4-2.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of the evince package.
Multiple security issues were fixed in the perses-cli-0.54.0-1.1 package included in the GA media of openSUSE Tumbleweed. These vulnerabilities affect the SUSE product but specific technical details and affected versions are not provided. The overall severity is assessed as medium.
This security update for OpenVPN addresses two denial of service vulnerabilities. The first (CVE-2026-13122) involves a reachable assertion triggered by a malformed authentication token when external-auth is enabled. The second (CVE-2026-13698) is a memory leak caused by remote attackers using a valid tls-crypt-v2 client key. Both issues can cause service disruption.
This security update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 addresses multiple security vulnerabilities affecting various kernel components including TLS, VXLAN, IPv6 ICMP, and KVM shadow paging. The update fixes race conditions, validation issues, use-after-free bugs, and memory allocation problems. These vulnerabilities have been assigned CVE identifiers CVE-2026-23240, CVE-2026-31738, CVE-2026-43038, CVE-2026-46113, CVE-2026-53359, and CVE-2026-53366. The update applies to specific SUSE Linux Enterprise kernel versions listed in the affectedVersions field.
This security update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 addresses multiple vulnerabilities including CVE-2026-31738 (vxlan ND option length validation), CVE-2026-43038 (IPv6 ICMP error handling), CVE-2026-46113 and CVE-2026-53359 (KVM x86 shadow paging use-after-free issues), and CVE-2026-53366 (IPv4 fragmentation gap handling). These fixes resolve various security issues that could potentially be exploited to compromise system stability or security. The update is part of a broader Linux kernel security maintenance effort covering multiple architectures and subsystems.
A security update for libpng16 has been released, updating the library to version 1.6.58. The update addresses multiple issues as noted in the upstream changes. No specific vulnerabilities or technical details are provided in the available information.
A security update for libpng16 has been released, updating the version to 1.6.58. The update addresses multiple issues as referenced in the upstream changes. No specific vulnerabilities or technical details are provided in the available information.
This security update for nsd addresses multiple vulnerabilities including a bypass of client certificate verification over TLS, out-of-bounds stack write with crafted APL resource records, denial of DNS over TLS service, and a heap overflow causing crashes with crafted SVCB resource records. The update includes version 4.14.3 which fixes these issues and adds various feature enhancements such as systemd notify support, dnstap support, and TCP fast open support.
This security update for perl-YAML-Syck addresses multiple memory-safety vulnerabilities in the libsyck library that are exploitable via the default YAML::Syck::Load() function when processing untrusted input. The fixed issues include out-of-bounds reads and use-after-free conditions that could lead to crashes or potentially other impacts. The update also hardens base64 decoding and enforces maximum depth limits to prevent stack exhaustion from deeply nested inputs.
This update for keybase-client fixes the following issues:
Changes in keybase-client:
- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
Multiple security issues were fixed in the ImageMagick-7.1.2.28-1.1 package distributed with openSUSE Tumbleweed. These vulnerabilities affect the ImageMagick software as packaged by SUSE. No specific details on the nature of the vulnerabilities or affected versions are provided.
Multiple security issues were fixed in the freerdp-3.30.0-1.1 package distributed on the GA media of openSUSE Tumbleweed. These issues affect various versions of FreeRDP across different Linux distributions including Ubuntu and SUSE. The vulnerabilities have been addressed in this updated package version.
CVE-2026-63308 is a medium severity security vulnerability affecting the helm3 package. It is addressed in the helm3-3.21.4-0.1.hum1 update for Red Hat Hardened Images and the helm3-3.21.3-4.1 package on openSUSE Tumbleweed. The vulnerability involves issues tracked under CWE-129 and CWE-1285. No known exploits are reported in the wild. The vendor has released an official fix.
A security vulnerability (CVE-2026-45700) in FreeRDP's planar bitmap decoder allows an out-of-bounds write that can lead to arbitrary code execution. This affects the xfreerdp client used to connect to RDP servers. Red Hat has issued a security update for Red Hat Enterprise Linux 9 and related variants to address this issue. The vulnerability is rated as high severity by Red Hat Product Security. The update fixes the flaw by correcting the out-of-bounds write condition.
Multiple security vulnerabilities were found and fixed in libssh, including a critical stack buffer overflow in the SFTP server's longname construction. This flaw allows attackers to cause buffer overflows by listing attacker-controlled filenames, potentially leading to crashes or code execution. Other issues include denial of service, information disclosure, integrity downgrade, and use-after-free vulnerabilities. Red Hat released updated packages (libssh-0.12.2-1.hum1) that address these issues. No workaround exists for the critical buffer overflow, so applying the update is necessary.
A security update for OpenSSL 3 addresses a denial-of-service (DoS) vulnerability identified as 'HollowByte' that involves attacker-controlled memory allocation. This vulnerability could allow an attacker to cause a DoS condition by manipulating memory allocation within OpenSSL. The update fixes this issue to improve the security and stability of the OpenSSL library.