Threat database

Multiple security issues have been fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed. These issues are collectively addressed in this updated package version. No specific details about individual vulnerabilities or their impacts are provided.

Multiple security vulnerabilities have been identified and fixed in nginx, including an authorization and rate limiting bypass when using the HTTP/3 QUIC module (CVE-2026-40460), a heap-based buffer overflow in proxy and gRPC modules (CVE-2026-42055), a heap buffer over-read in the charset module (CVE-2026-48142), and an HTTP/2 denial of service issue. These vulnerabilities could lead to denial of service or potentially arbitrary code execution. Official patches are available from vendors such as SUSE, Ubuntu, and Red Hat.

Multiple security issues were addressed in the python-magic-wormhole-bash-completion-0.24.0-1.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the package but specific vulnerability details are not provided.

These are all security issues fixed in the MozillaThunderbird-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

A low severity denial of service vulnerability (CVE-2024-58251) in net-tools was identified by the SUSE Product Security Team. The issue is triggered by terminal escape sequences. No CVSS score or known exploits in the wild are reported. A security update addressing this vulnerability has been released by SUSE. Specific affected versions are not clearly stated beyond certain SUSE package versions.

Multiple security issues were fixed in the libsrt1_5-1.5.6-1.1 package on the GA media of openSUSE Tumbleweed. The vulnerabilities affect the libsrt1_5 library as distributed by SUSE. No specific technical details or affected versions are provided. The severity is assessed as medium.

CVE-2026-42006 is a denial of service vulnerability in the Dovecot IMAP server caused by uncontrolled memory usage triggered by sending excessive bracing characters over IMAP. The issue is a bypass of a previous incomplete fix related to open braces, allowing memory consumption up to the configured limit. Red Hat has released security updates addressing this vulnerability for multiple versions of Red Hat Enterprise Linux and related products. No public exploits are known at this time.

This security update for perl-XML-Bare addresses two vulnerabilities: CVE-2026-13401, where the parser would hang when processing malformed XML attributes, and CVE-2026-57074, which involves an unbounded character lookahead issue. Both issues could affect the stability and reliability of XML parsing in the perl-XML-Bare module.

Multiple medium severity security issues were addressed in the libtree-sitter0_26 package version 0.26.8-5.1 for openSUSE Tumbleweed, improving the security posture of the nm-configurator component. These vulnerabilities affect earlier versions of the package and have been resolved in the updated release. No CVSS score is provided for these issues.

A security update for perl-HTTP-Date addresses CVE-2026-14741, which involves CPU exhaustion caused by polynomial regex backtracking in the parse_date function. This vulnerability can lead to denial of service conditions due to excessive CPU usage. The issue has been fixed in the update provided by the SUSE Product Security Team.

A security update for PackageKit addresses CVE-2026-10294, which involves improper authorization due to manipulation of the argument frontend-socket. This vulnerability could allow unauthorized actions within PackageKit. The update also fixes a non-security issue related to KDE Discover ignoring package locks.

A directory traversal vulnerability (CVE-2026-26032) in Apache Ivy allows overwriting arbitrary files outside the configured buildRoot directory via crafted module coordinates. This issue is addressed by upgrading to Apache Ivy version 2.6.0, which also includes various other fixes and improvements.

A security update for the Shibboleth Service Provider (shibboleth-sp) addresses a high-severity SQL injection vulnerability identified as CVE-2025-9943. The flaw exists in the handling of the "ID" attribute within the SAML response when the replay cache is configured to use an SQL database for storage. This vulnerability could allow an attacker to perform SQL injection attacks against the backend database used by the replay cache.

A local denial-of-service (DoS) vulnerability (CVE-2025-59529) exists in Avahi due to the simple protocol server ignoring the client limit CLIENTS_MAX, potentially causing resource exhaustion. This issue affects Avahi versions from 0.8 up to but not including 0.9~rc2-8.1.hum1. A security update addressing this vulnerability has been released by Red Hat and SUSE. The severity of this vulnerability is assessed as medium.

This security update for Perl addresses multiple vulnerabilities including uncaught exceptions in zip header parsing, heap buffer overflow in regex compilation on 32-bit builds, heap memory disclosure in socket operations, integer overflow causing out-of-bounds heap reads, and regex trie branch-count overflow leading to incorrect pattern matching. These issues collectively pose a high risk to affected systems. No specific affected versions beyond those stated are provided. No known exploits in the wild have been reported. The update fixes these issues to improve Perl's security and stability.

A security update for the 'joe' text editor addresses CVE-2026-13412, which involves improper validation in the tag-file parser. This vulnerability can lead to arbitrary command execution. The issue was identified and fixed by the SUSE Product Security Team. No specific affected versions are provided. The severity is assessed as high due to the potential for command execution.

This security update for perl-DBI addresses multiple vulnerabilities including unauthorized file access due to symbolic link validation failure, bypass of file-backed filters from incorrect predicate evaluation, a memory-amplification denial of service via unbounded path index in profile parsing, and a process crash caused by out-of-bounds access in statement handle processing. The vulnerabilities collectively pose a high severity risk. The update targets specific SUSE platform versions and architectures.

These are all security issues fixed in the kernel-devel-7.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for GraphicsMagick fixes the following issue - CVE-2026-61870: Memory leak in VIFF encoder when allocation fails (bsc#1271293).