Threats affecting pkg:generic/openjph

VMime versions up to 0.9.2 have an information disclosure vulnerability in the uuEncoder::decode function. This flaw causes uninitialized stack memory to be written into decoded output when processing over-long lines in uuencoded MIME parts. An attacker can exploit this by sending crafted uuencode or x-uuencode MIME parts with large line length bytes, potentially leaking up to 15 bytes of stack memory per line in decoded attachments.

VMime versions up to 0.9.2 contain a stack-based buffer overflow vulnerability in the uuEncoder::decode function. This flaw arises from an integer underflow triggered by crafted uuencoded MIME parts in emails. An attacker can send a specially crafted email with a uuencoded line whose length character is 'b' but is not a 'begin' line, leading to stack memory corruption. This can cause the application to crash or potentially allow remote code execution.

CVE-2026-116737 is a heap out-of-bounds read vulnerability in libphdi, a component of libyal. The flaw occurs in the function libphdi_data_files_get_extent_data_file_path, which incorrectly calculates buffer size by using the directory prefix length instead of the basename length. This can be triggered by a crafted Parallels disk image descriptor with a long directory prefix and a short basename, potentially causing a process crash or exposure of adjacent heap memory.

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.

libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.

flatcc versions up to 0.6.4 have an integer overflow vulnerability in the check_header function of the FlatBuffers verifier. On 32-bit builds, this flaw allows crafted buffer offsets to bypass bounds checks, leading to out-of-bounds reads before the buffer and potential process crashes.

CVE-2026-116733 is an out-of-bounds read vulnerability in flatcc versions up to 0.6.4. It occurs in the __flatcc_json_parser_number function when parsing JSON numbers ending with a decimal point. This flaw allows attackers to read beyond the input buffer, potentially causing application crashes.

libdwarf versions up to 2.3.3 contain a heap out-of-bounds read vulnerability in the dwarf_debug_addr_table() function. This flaw occurs because the function omits the table starting offset when validating the .debug_addr unit length. An attacker can exploit this by supplying a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read beyond the allocated heap buffer. This can lead to disclosure of adjacent heap memory or cause a crash in programs using libdwarf.

Furnace versions up to 0.6.8.3 have an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to corrupt heap memory by using a crafted FamiTracker module with a subsong count of two or more, causing a write beyond the subsong vector and potentially crashing the application when the module is opened.

Furnace versions up to 0.6.8.3 have an out-of-bounds heap read vulnerability in the DivEngine::loadFTM() function. This flaw occurs when importing FamiTracker modules with an unbounded DPCM note count, allowing crafted files to read beyond the noteMap array and cause a crash.

CVE-2026-116729 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 volumes. The flaw occurs in the function libfvde_encrypted_metadata_read_type_0x001a() due to an unbounded strlen call on embedded XML plist data that is not properly NUL-terminated. An attacker can craft a malicious FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read beyond the allocated heap buffer.

CVE-2026-116728 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 Core Storage volumes. The flaw occurs because the size of XML plist data is not properly checked against the source metadata block, allowing an attacker to cause a buffer over-read. This can lead to application crashes when processing crafted volumes.

gbsplay versions up to 0.0.103 contain a heap out-of-bounds read vulnerability in the vgm_open() function. This occurs because the function processes VGM command streams without proper bounds checking, allowing a crafted VGM file with specific wait opcodes and missing a 0x66 terminator to cause a read beyond the allocated heap buffer, potentially crashing the player.

Gbsplay versions up to 0.0.103 have a heap out-of-bounds read vulnerability in the gbr_open() function within gbs.c. This occurs because the function does not properly verify the length of the input GBR file before scanning the ROM title field. An attacker can craft a GBR file sized between 0x21 and 0x162 bytes to trigger reading beyond the allocated heap buffer, potentially causing a crash or memory leakage.

An out-of-bounds read vulnerability exists in gbsplay through version 0.0.103 in the mapper_map() function. This flaw allows crafted .gbr, .gbs, or .gb files with malicious ROM bank indexes to cause the player to read beyond the allocated heap buffer, potentially crashing the application.

FLTK versions up to 1.4.5 have an integer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw causes the application to allocate an undersized pixel buffer based on file-supplied width and height values. An attacker can exploit this by providing a crafted BMP or ICO file with large dimensions, leading to heap buffer overflow and corruption of the application heap.

FLTK versions up to and including 1.4.5 have a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw occurs when processing BMP or ICO files with a colors_used field value exceeding 256, which overflows a 768-byte colormap array. Exploitation can lead to application crashes or potentially allow code execution.

CVE-2026-116590 is a vulnerability in the xerial snappy-java library prior to version 1.1.10.9. It involves improper validation of array indices in the Snappy.arrayCopy method, which allows passing negative or oversized offset and byteLength values to native memcpy calls. This can cause out-of-bounds reads or writes, potentially crashing the Java Virtual Machine (JVM). The issue affects methods like SnappyOutputStream.rawWrite and SnappyInputStream.rawRead that use this primitive. The vulnerability is fixed in version 1.1.10.9.

CVE-2026-116514 is a cross-site scripting (XSS) vulnerability in itsourcecode Airline Reservation System version 1.0. The flaw exists in the /book_flight.php file where manipulation of the 'max' argument can lead to XSS. This vulnerability can be exploited remotely and requires user interaction. Public exploit code is available. The CVSS 4.0 base score is 5.3, indicating a medium severity.

A buffer overflow vulnerability was addressed by improving bounds checking in several Apple operating systems. The flaw could cause unexpected process termination when processing a maliciously crafted file. Fixed versions include iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2.