Threats affecting pkg:generic/librsvg

An out-of-bounds write vulnerability in Apple macOS could allow an application to cause unexpected system termination. This issue has been addressed with improved bounds checking and fixed in macOS Golden Gate 27 and macOS Tahoe 26.7.2.

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to bypass certain Privacy preferences.

CVE-2026-84610 is a vulnerability in Apple macOS where a maliciously crafted ZIP archive may bypass Gatekeeper checks, which are designed to prevent untrusted software from running. This issue involves a file quarantine bypass that has been addressed with additional checks in updated macOS versions. The vulnerability is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.

A vulnerability in Apple macOS allows a malicious application to create files in protected directories. This security issue has been addressed with improved checks and fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-86969 is a vulnerability in Apple iOS, iPadOS, and macOS that involves an out-of-bounds write due to insufficient input validation. This flaw could allow a malicious app to cause unexpected system termination or corrupt kernel memory. The issue has been addressed and fixed in iOS and iPadOS versions 26.7.2 and 27.2, as well as macOS Golden Gate 27.2, Sequoia 15.8.2, and Tahoe 26.7.2.

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.

A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

A use-after-free vulnerability in Apple Safari could cause the browser to crash when processing maliciously crafted web content. This issue has been addressed with improved memory management and fixed in Safari 27.2, iOS 26.7.2, iPadOS 26.7.2, and related Apple operating system versions.

A vulnerability in Apple macOS allows an app to read files outside of its sandbox due to insufficient access restrictions. This issue has been addressed and fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.

CVE-2026-65384 is an out-of-bounds read vulnerability in Apple macOS that could allow a remote attacker to cause an unexpected process termination. The issue was addressed by improved input validation and fixed in macOS Golden Gate version 27.2.

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An attacker in physical proximity may be able to corrupt process memory.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (1bbe1eb2e2e46c8aa452e19060d6f37d8e744e62e5c58be091c4e1f263a09d1a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

A vulnerability in Apple iOS and iPadOS allowed a malicious app to access the camera without user permission. This access issue was addressed by Apple with improved access restrictions. The flaw is fixed in iOS and iPadOS versions 18.7.11, 26.7.2, and 27.2, as well as corresponding macOS and visionOS versions.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.

CVE-2026-65392 is a permissions vulnerability in Apple macOS where an app with root privileges could access private information. The issue was addressed by adding additional restrictions and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify protected parts of the file system.