Threat database

Multiple security vulnerabilities affecting the cosign tool and related Go cryptography libraries have been identified and fixed. These include issues parsing HTML files, a memory-safety vulnerability, and multiple issues in golang.org/x/crypto/ssh. The vulnerabilities have been addressed in updated versions provided by SUSE and Red Hat. A patch is available to remediate these issues.

A high severity out-of-bounds write vulnerability (CVE-2026-50593) affects certain SUSE packages of graphite2 and related libraries. The issue is addressed by a security update provided by the SUSE Product Security Team. No CVSS score is available, and there are no known exploits in the wild.

A security update for perl-HTTP-Daemon addresses a vulnerability identified as CVE-2026-8450. This vulnerability allows OS command injection via the send_file() function in versions before 6.17. The issue is rated as high severity. No specific affected versions were explicitly stated beyond the indication that versions before 6.17 are vulnerable.

A security update for perl-Protocol-HTTP2 addresses a denial of service vulnerability identified as CVE-2026-10725. The issue arises from the absence of an inbound HPACK header-list size limit, which could be exploited to cause denial of service. This vulnerability has been assigned a high severity level. No specific affected versions are stated in the provided data. There is no information about known exploits in the wild or a CVSS score. The update fixes this issue to prevent potential denial of service attacks.

A vulnerability in perl-HTML-Parser (CVE-2026-8829) affects versions before 3.84, where HTML:Entities incorrectly handles entity references leading to reading freed heap memory. This flaw could allow an attacker to expose sensitive information. The issue is fixed in updated package versions provided by Ubuntu and SUSE. Users are advised to update to these fixed versions to mitigate the risk.

Multiple security vulnerabilities affecting dovecot24 have been addressed in an update to version 2.4.4. These include issues such as a filter leak in lib-var-expand, IPC protection bypass via base64 input containing tabs, inefficient substring matching bypassing CPU time limits in Sieve, shared-spam of IMAP folders, and uncontrolled memory usage from excessive bracing in IMAP login. The update fixes these high-severity issues.

This security update for xwayland addresses multiple vulnerabilities including use-after-free issues and stack-based buffer overflows affecting various components such as CreateSaverWindow, Font Alias, GLX ChangeDrawableAttributes, XKB Key Types, XKB SetMap Request, and XSYNC functions. These vulnerabilities could lead to information disclosure and memory corruption. The update fixes these issues to improve security.

An integer overflow vulnerability (CVE-2026-42046) exists in the canvas import functionality of libcaca. This flaw may allow an attacker to cause a controlled heap out-of-bounds write. The issue is addressed by a security update from the SUSE Product Security Team. No specific affected versions or patch details are provided. No known exploits in the wild have been reported.

A security update for perl-Compress-Raw-Zlib addresses multiple issues including a fix related to CVE-2026-3381. The update involves upgrading the perl-Compress-Raw-Zlib package to version 2.222, which includes security fixes and other improvements. The CVE-2026-3381 vulnerability is associated with the underlying zlib 1.3.2 library. No specific affected versions are stated in the provided data.

This security update for perl-Cpanel-JSON-XS addresses multiple issues including fixes for CVE-2025-40929 related to overflow with overlong numbers, and other bugs affecting JSON encoding and decoding. The update improves handling of malformed numbers, fixes memory corruption and type confusion vulnerabilities, and aligns behavior with JSON::PP. The update is critical due to the nature of the overflow vulnerability and other memory-related fixes.

This update for zypper, libzypp, libsolv fixes the following issues: Changes in zypper: Update to 1.14.98: - Transactional systems: Delegate rw-commands to transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607) On a transactional system where the root filesystem is mounted read-only, zypper commands that modify the system cannot be executed directly. If the system provides a transactional-wrapper utility, zypper will automatically attempt to invoke it. The wrapper transparently executes the zypper command within a new, writable snapshot and manages the lifecycle of that snapshot based on the command's exit status. On transactional systems lacking a transactional-wrapper, users must manually invoke specialized tools -such as transactional-update- to install, update, or remove software. - Add --filter-version-change to zypper lu. Adds filtering by version change significance to reduce noise in update listings. Supports levels: rebuild (hides rebuild-only changes) and package (hides all release-only changes). - Autorefresh ris-services the way as plugin-services (bsc#1246504) It's actually wrong to treat service refreshes different depending on the service type. For the purpose of a service it makes no difference how the data about the repos to use are acquired. Changes in libzypp: Updated to 17.38.13: - A .repo files "path=" entry must not refer to a location outside the repo (bsc#1267874, CVE-2026-44942) A "path=" entry may solely denote a sub-directory of the baseurl where the metadata are located. A relative path trying to access data outside the baseurl is reported and sanitized. - Repo "keyhint" must denote a filename, no path (bsc#1267426, CVE-2026-44941) - Fix potential crash on malformed or malicious repository metadata (fixes #740) - Repo metadata: discard entries referring to a location outside the repo (bsc#1259802, CVE-2026-25707) Mirroring those data locally would refer to a location outside the repo's local cache directory. Those data entries are reported and discarded. - zypp.conf: Allow [env] section to add environment variables. This feature is designed to enable environment-specific settings or debugging options over an extended period. See zypp.conf(5). - Prevent configured scripts from escaping the sigcheck directory (bsc#1265223, CVE-2026-44933) - StringV: guard hasPrefix/hasPrefixCI against reading past the view end (fixes #735) - Mandatory signature verification plugin support (PED#11922) - Fix purge-kernel -rc kernel handling (bsc#1239718) - Explicitly_set_pool_DISTTYPE_RPM (fixes #726) - Check for trusted key updates when updating the general keyring (bsc#1259706) - Support multiple MirroredOrigin authorities (bsc#1253193) - Workaround doxygen bug: doxygen/doxygen#12057 - libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842) Changes in libsolv: Updated to 0.7.39: - fix solv_chksum_free segfault when called with a NULL pointer - made repo_add_solv more robust against corrupt files [bsc#1265935] [CVE-2026-9149] - fix potential buffer overflow when verifying EdDSA signatures [bsc#1266039] [CVE-2026-48863] - added limit checks in multiple places to catch overflows - reduce the size of the language id cache - fixed Debian canon selection - fixed dbpath detection in repo_rpmdb_librpm - reduced stack usage in repo page compression (needed for musl) - fix parsing of sha512 checksums in debian repositories [bsc#1265938] [CVE-2026-9150] - improve speed of dirpool_add_dir makeing parsing of filelists.xml twice as fast - fix parsing of recommends in the old Mandriva synthesis format

PyJWKClient in the kimi-cli library allows fetching JSON Web Key Sets (JWKS) from URLs with schemes beyond HTTP and HTTPS, including file://, ftp://, and data:. This can lead to server-side request forgery (SSRF) on local files and other protocols. An attacker who can influence the jku URL and write to a local file path can forge JWT tokens that the application accepts as valid. The vulnerability affects PyJWT versions 2.11.0 and 2.12.1 and likely earlier versions. A fix is available that restricts allowed URL schemes to HTTP and HTTPS.

These are all security issues fixed in the freerdp-3.27.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for unbound fixes the following issues - CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583). - CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587). - CVE-2026-40622: "Ghost domain name" variant (bsc#1265581). - CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580). - CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585). - CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589). - CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578). - CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586). - CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588). - CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584). - CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for java-1_8_0-ibm fixes the following issues - CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490). - CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494). - CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495). - CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496). - CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497). - CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500). - CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261) Changes for java-1_8_0-ibm: - Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)

A security update for perl-Crypt-PasswdMD5 addresses a weakness by replacing the use of the cryptographically weak rand() function with the stronger Crypt::URandom::urandom(). This update corresponds to version 1.43 and fixes CVE-2026-6659. The update is classified as a security upgrade by the SUSE Product Security Team.

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.

Multiple security vulnerabilities have been addressed in libheif with the release of version 1.23.0. These include heap buffer over-reads, out-of-bounds reads and writes, integer overflows, infinite loop denial-of-service, null pointer dereferences, and information disclosure issues. The vulnerabilities arise from malformed or crafted HEIF image files and affect various components such as overlay compositing, sample duration lookup, mask image decoding, and metadata parsing. The update also includes new API functions and other feature enhancements.

Multiple security issues affecting the libopenvswitch-3_7-0 package for openSUSE Tumbleweed on the aarch64 architecture have been addressed in version 3.7.1-33.1. The fixes are included in the general availability release media. The severity of these issues is assessed as medium. No CVSS score is provided. No known exploits are reported in the wild.

This update for MozillaFirefox fixes the following issues - Update to Firefox Extended Support Release 140.11.0 ESR MFSA 2026-48 (bsc#1265212). MFSA 2026-48: - CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component. - CVE-2026-8391: Other issue in the JavaScript Engine component. - CVE-2026-8401: Sandbox escape in the Profile Backup component. - CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component. - CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component. - CVE-2026-8949: Integer overflow in the Widget: Win32 component. - CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component. - CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access APIs component. - CVE-2026-8954: Incorrect boundary conditions, integer overflow in the Audio/Video component. - CVE-2026-8955: Privilege escalation in the DOM: Workers component. - CVE-2026-8956: Integer overflow in the Networking: JAR component. - CVE-2026-8957: Privilege escalation in the Enterprise Policies component. - CVE-2026-8958: Information disclosure, sandbox escape in the Security: Process Sandboxing component. - CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. - CVE-2026-8961: Spoofing issue in the Form Autofill component. - CVE-2026-8962: Mitigation bypass in the DOM: Security component. - CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. - CVE-2026-8970: Privilege escalation in the Security component. - CVE-2026-8974: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151. - CVE-2026-8975: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151.