A security update for OpenSSL 3 addresses a denial-of-service (DoS) vulnerability identified as 'HollowByte' that involves attacker-controlled memory allocation. This vulnerability could allow an attacker to cause a DoS condition by manipulating memory allocation in OpenSSL 3. The update fixes this issue to prevent such exploitation.
Multiple security issues have been fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed. These issues are collectively addressed in this updated package version. No specific details about individual vulnerabilities or their impacts are provided.
Multiple security vulnerabilities have been identified and fixed in nginx, including an authorization and rate limiting bypass when using the HTTP/3 QUIC module (CVE-2026-40460), a heap-based buffer overflow in proxy and gRPC modules (CVE-2026-42055), a heap buffer over-read in the charset module (CVE-2026-48142), and an HTTP/2 denial of service issue. These vulnerabilities could lead to denial of service or potentially arbitrary code execution. Official patches are available from vendors such as SUSE, Ubuntu, and Red Hat.
Multiple security issues were addressed in the python-magic-wormhole-bash-completion-0.24.0-1.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the package but specific vulnerability details are not provided.
A low severity denial of service vulnerability (CVE-2024-58251) in net-tools was identified by the SUSE Product Security Team. The issue is triggered by terminal escape sequences. No CVSS score or known exploits in the wild are reported. A security update addressing this vulnerability has been released by SUSE. Specific affected versions are not clearly stated beyond certain SUSE package versions.
Multiple security issues were fixed in the libsrt1_5-1.5.6-1.1 package on the GA media of openSUSE Tumbleweed. The vulnerabilities affect the libsrt1_5 library as distributed by SUSE. No specific technical details or affected versions are provided. The severity is assessed as medium.
CVE-2026-42006 is a denial of service vulnerability in the Dovecot IMAP server caused by uncontrolled memory usage triggered by sending excessive bracing characters over IMAP. The issue is a bypass of a previous incomplete fix related to open braces, allowing memory consumption up to the configured limit. Red Hat has released security updates addressing this vulnerability for multiple versions of Red Hat Enterprise Linux and related products. No public exploits are known at this time.
Multiple medium severity security issues were addressed in the libtree-sitter0_26 package version 0.26.8-5.1 for openSUSE Tumbleweed, improving the security posture of the nm-configurator component. These vulnerabilities affect earlier versions of the package and have been resolved in the updated release. No CVSS score is provided for these issues.
A security update for PackageKit addresses CVE-2026-10294, which involves improper authorization due to manipulation of the argument frontend-socket. This vulnerability could allow unauthorized actions within PackageKit. The update also fixes a non-security issue related to KDE Discover ignoring package locks.
A security update for the Shibboleth Service Provider (shibboleth-sp) addresses a high-severity SQL injection vulnerability identified as CVE-2025-9943. The flaw exists in the handling of the "ID" attribute within the SAML response when the replay cache is configured to use an SQL database for storage. This vulnerability could allow an attacker to perform SQL injection attacks against the backend database used by the replay cache.
A local denial-of-service (DoS) vulnerability (CVE-2025-59529) exists in Avahi due to the simple protocol server ignoring the client limit CLIENTS_MAX, potentially causing resource exhaustion. This issue affects Avahi versions from 0.8 up to but not including 0.9~rc2-8.1.hum1. A security update addressing this vulnerability has been released by Red Hat and SUSE. The severity of this vulnerability is assessed as medium.
This security update for Perl addresses multiple vulnerabilities including uncaught exceptions in zip header parsing, heap buffer overflow in regex compilation on 32-bit builds, heap memory disclosure in socket operations, integer overflow causing out-of-bounds heap reads, and regex trie branch-count overflow leading to incorrect pattern matching. These issues collectively pose a high risk to affected systems. No specific affected versions beyond those stated are provided. No known exploits in the wild have been reported. The update fixes these issues to improve Perl's security and stability.
A security update for the 'joe' text editor addresses CVE-2026-13412, which involves improper validation in the tag-file parser. This vulnerability can lead to arbitrary command execution. The issue was identified and fixed by the SUSE Product Security Team. No specific affected versions are provided. The severity is assessed as high due to the potential for command execution.
Multiple security issues were fixed in the Linux kernel package kernel-devel-7.1.4-1.1 for openSUSE Tumbleweed and related distributions. These issues affect various architectures and subsystems, including ARM64, ARM32, RISC-V, x86, and many kernel components and drivers. The vulnerabilities could allow local attackers to bypass memory protections or escalate privileges. Affected versions include specific older kernel builds prior to the fixed versions listed. A patch is available and upgrading to the fixed kernel versions is recommended.
A security update for the beets software addresses a vulnerability identified as CVE-2026-42052. Prior to version 2.10.0, the bundled web UI of beets uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields, which can lead to security issues. This vulnerability is rated medium severity. No specific affected versions or patch links are provided in the data.
A security update for gpg2 addresses a low severity vulnerability (CVE-2026-57062) involving improper handling of the CMS format for AES-GCM in the gpgsm component, which could cause parsing errors. No specific affected versions or patch details are provided in the available data.