A security update for perl-Config-IniFiles addresses CVE-2026-11527, which involves OS command injection and file overwrite vulnerabilities via a two-argument open() call of the -file argument in the _make_filehandle function. This vulnerability could allow an attacker to execute arbitrary commands or overwrite files. The issue is recognized by the SUSE Product Security Team and classified as high severity. No specific affected versions or patch details are provided in the available data.
This security update for rpcbind addresses multiple issues including a stack buffer overflow in rpcinfo, unauthenticated oversized allocation in rpcbind, and several memory leaks. It also introduces various hardening options and updates to configuration and documentation. The update corresponds to rpcbind version 1.2.9.
This security update for rpcbind addresses multiple issues including a stack buffer overflow in rpcinfo's rpcbaddrlist(), unauthenticated oversized allocation in PMAPPROC_CALLIT decode, and several memory leaks. Additional improvements include hardening options in systemd service files and configuration relocations. The update corresponds to rpcbind version 1.2.9.
This security update for libexif addresses multiple vulnerabilities related to integer underflow and overflow in the decoding of MakerNotes metadata. The issues include buffer overwrite, information disclosure, crashes, and denial of service. These vulnerabilities affect specific SUSE libexif packages and architectures. The severity is assessed as medium based on the described impacts.
A security update for dnsdist addresses multiple vulnerabilities including injection of HTML content, CORS misconfiguration leading to information disclosure, out-of-bounds reads and writes, denial of service via excessive memory allocation or crafted queries, use-after-free conditions, and input validation issues in the internal webserver. The update fixes these issues by upgrading dnsdist to version 1.9.13.
This security update for perl-DBI addresses two vulnerabilities affecting versions prior to 1.648. The first vulnerability (CVE-2026-9698) involves saving errors in a limited-sized buffer, and the second (CVE-2026-10879) involves a heap overflow triggered by SQL statements with more than 9 binders. Both vulnerabilities can cause memory corruption or instability in applications using affected versions of perl-DBI.
Pallets Click versions 8.3.2 and below contain a command injection vulnerability in the click.edit() function. This flaw allows attackers to execute arbitrary operating system commands from an unprivileged account. A security update addressing this issue is available. The vulnerability has been rated with medium severity. There are no known exploits in the wild at this time.
This update for sed fixes the following issue
- CVE-2026-5958: a TOCTOU race can allow to read attacker-controlled content and write it to an unintended file
(bsc#1262144).
A medium severity time-of-check to time-of-use (TOCTOU) vulnerability exists in the mount program of util-linux related to loop device setup. This issue, tracked as CVE-2026-27456, was identified by the SUSE Product Security Team. A security update addressing this vulnerability is available for specific SUSE packages on the aarch64 architecture. No known exploits have been reported in the wild.
This security update for mbedtls addresses multiple critical vulnerabilities fixed in version 3.6.6, including buffer underrun, certificate verification flaws, authentication bypass, memory management errors, timing side channels, race conditions, and RNG state duplication issues. These vulnerabilities affect cryptographic operations and could lead to key extraction, signature bypass, downgrade attacks, and other serious security impacts.
This security update for mbedtls-2 addresses multiple issues including enabling SRTP and DTLS protocols, changing default TLS client behavior to require hostname verification, fixing a TLS 1.2 handshake vulnerability related to memory allocation or cryptographic hardware failures, and several bug fixes. The update enforces that TLS clients call mbedtls_ssl_set_hostname() to prevent server impersonation, returning an error if not set. It also zeroizes temporary heap buffers used in PSA operations and fixes potential double close file descriptor problems and compilation issues.
A security update for gsasl addresses a vulnerability identified as CVE-2026-48829, which involves a NULL pointer dereference in the DIGEST-MD5 parser. This issue could cause a denial of service or application crash. The vulnerability is rated as high severity. No specific affected versions are provided in the available data.
This security update for tree-sitter-ruby addresses multiple issues including CVE-2025-5889, which involves inefficient regular expression complexity in the brace-expansion function, and CVE-2025-59343, a symlink validation bypass in tar-fs. The update also includes various fixes and improvements to the parser, scanner, and build processes. No specific affected versions are stated. The severity is assessed as medium based on the described impact.
The container-selinux package provides SELinux policies for container runtimes.
Security Fix(es):
* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)
Bug Fix(es) and Enhancement(s):
* [rhel-10.0.z] avc: denied { prog_run } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:container_runtime_t:s0 tclass=bpf (JIRA:RHEL-210644)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security update for glycin-loaders addresses two vulnerabilities: CVE-2025-55159, an incorrect bounds check in the get_disjoint_mut function that can cause undefined behavior or a crash due to out-of-bounds access; and CVE-2025-58160, which involves tracing log pollution. Both issues have been identified and fixed by the SUSE Product Security Team.
A security update for glib-networking addresses CVE-2026-10028, a vulnerability where two certificates signed by each other can cause an infinite loop during certificate validation. This issue affects the certificate validation process in glib-networking. No specific affected versions or patch details are provided in the available data. The vulnerability has a medium severity rating and no known exploits in the wild have been reported.
A heap buffer overflow vulnerability exists in libjxl when processing crafted PBM images due to insufficient bounds checks. This issue affects the mozjs128 component in SUSE products. The vulnerability is identified as CVE-2025-70103 and is rated with high severity. A security update has been issued by the SUSE Product Security Team to address this flaw.
This security update for libyang addresses two vulnerabilities: a use-after-free issue in the function lyd_parser_set_data_flags when processing crafted YANG XML documents with specific metadata attributes (CVE-2026-41401), and an integer overflow in lyb_read_string() leading to a heap buffer overflow when parsing maliciously crafted LYB binary blobs (CVE-2026-44673). Both vulnerabilities could lead to memory corruption and potential exploitation. The update fixes these issues to prevent such attacks.
Multiple security vulnerabilities affecting FreeRDP were fixed in version 3.26.0. These include heap-buffer-overflow, out-of-bounds read and write, double-free, off-by-one errors, and path traversal issues. The flaws impact various components such as the clipboard channel, RDPGFX PDUs, RDPEAR authentication, and kerberos security context functions. The update addresses these issues to prevent potential denial of service, information disclosure, and remote code execution.