Threat database

This security update for lrzip addresses multiple vulnerabilities including use-after-free and NULL pointer dereference issues triggered by corrupt or malicious archives and improper command-line parameters. The update to version 0.660 fixes these issues by improving thread cleanup, handling of command-line options, and adding bounds and sanity checks. Additional portability and build fixes are also included.

This security update for python-pytest-html addresses vulnerabilities in its dependencies shell-quote and js-yaml. The shell-quote vulnerability (CVE-2026-13311) involves inefficient input parsing that can lead to denial of service. The js-yaml vulnerability (CVE-2026-53550) involves quadratic complexity when processing crafted YAML documents, potentially causing CPU exhaustion. Both issues are fixed by updating the respective dependencies.

Red Hat® AI Inference Server

This security update provides a functional equivalent of RHSA-2026:33514. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:33514.

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues The following security issues were fixed: - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640). - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088). - CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108). - CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902). - CVE-2026-43503: final dirty.frag related fixes (bsc#1266229). - CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282). - net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

A security update for GIMP addresses a vulnerability identified as CVE-2026-40917 related to the cleanup of ICNS file loading in plug-ins. The update fixes issues that could potentially affect the security of the application. No specific affected versions are stated in the available information.

A security update for python-biopython addresses CVE-2025-68463, an information disclosure vulnerability caused by an XML External Entity (XXE) issue. This vulnerability could allow unauthorized disclosure of information. The update fixes this issue to prevent such disclosure. No specific affected versions are stated. No CVSS score is provided, but the severity is assessed as medium.

A security update for dnsmasq addresses multiple issues including a heap buffer overflow vulnerability (CVE-2026-12725) in the log_query() function when logging unsupported DS/DNSKEY replies. Additional fixes include DNSSEC validation corner cases, DHCPv6 regression, and storage allocation improvements for domain names (CVE-2026-2291).

Multiple security issues were addressed in the socat-1.8.1.3-1.1 package included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities fixed are not detailed in the provided information.

A double-free vulnerability (CVE-2026-56109) exists in the parse_def() function within src/conf.c of the ALSA library. This flaw allows attackers to corrupt memory, potentially leading to instability or other unintended behavior. The issue has been addressed in updated ALSA packages provided by Red Hat and SUSE.

Multiple security issues were addressed in the logback-1.5.36-1.1 package included in the GA media of openSUSE Tumbleweed. These vulnerabilities affect the logback components on the specified SUSE platform and architecture. A patch is available to remediate these issues. The severity of these vulnerabilities is assessed as medium.

These are all security issues fixed in the tekton-cli-0.45.1-1.1 package on the GA media of openSUSE Tumbleweed.

A security update for ImageMagick addresses multiple vulnerabilities including buffer overflows, information disclosure, denial of service, heap use-after-free, and memory leaks across various image processing components. These issues affect the handling of different image formats and server processes. The update also fixes a non-security issue related to softlinks. No specific affected versions are provided in the data.

A high-severity vulnerability in the tar utility (CVE-2025-45582) allows crafted archives to exploit improper handling of symbolic links during extraction, potentially enabling arbitrary file overwrites. This issue affects multiple versions of tar distributed with Ubuntu LTS releases and SUSE. Patches addressing this vulnerability are available and should be applied through standard system updates.

A security update addresses multiple issues in several Python packages including python-Markdown, python-joblib, python-handy-archives, python-apache-libcloud, python-WebOb, python-PyGithub, and python-soupsieve. Notably, python-WebOb fixes a security vulnerability (CVE-2026-44889) related to open redirect via Location header normalization during redirects. Other changes mainly involve test fixes and compatibility updates with recent Python versions. No known exploits are reported in the wild.

This security update for capnproto addresses two vulnerabilities related to HTTP smuggling caused by improper handling of HTTP header values in KJ-HTTP. The first vulnerability (CVE-2026-32239) involves a negative Content-Length conversion treated as an impossibly large length, and the second (CVE-2026-32240) involves an integer overflow when parsing Transfer-Encoding chunk sizes of 2^64 or larger. The update also includes other bug fixes and improvements.

This security update for python-py7zr addresses three vulnerabilities: CVE-2026-23879 allows arbitrary file write via crafted malicious symbolic link chains in an archive; CVE-2026-55195 involves unchecked extraction size that can cause denial of service; and CVE-2026-55206 involves a crafted .7z archive with a large numstreams value that can also cause denial of service. These issues have been publicly disclosed and are rated with high severity. No specific affected versions or patch details are provided in the input data.

This security update for openCryptoki addresses multiple vulnerabilities including CVE-2026-22791, which involves heap corruption or denial-of-service caused by a malformed compressed EC public key, and CVE-2026-23893, which involves privilege escalation or data exposure via symlink following. The update also adds new cryptographic support features and enhancements. The vulnerabilities affect openCryptoki versions before 3.26.0. The update upgrades openCryptoki to version 3.26 to fix these issues.

This update for libssh2_org fixes the following issues - CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530). - CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).