Threat database

This update for redis fixes the following issues: Changes in redis: - Update to 8.10.1 Update urgency: SECURITY: There are security fixes in the release. - Security fixes - (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write - Out-of-bounds access in TopK heap cleanup path (MOD-15410) - Use-after-free in the TLS pending-data list when a command closes another pending connection - A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution - Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access - Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running - Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays - TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user - #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key - Restrict the "modules" flavour to x86_64 and aarch64 -- RedisBloom and RedisTimeSeries abort on anything else with "only supports 64-bit architectures (x64, arm64v8)", redisjson's vendored redis-module is 64-bit only, and modules/common.mk maps no other architecture at all - Update to 8.10.0 Major changes compared to 8.8 - Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema - New command: HIMPORT - high-throughput compact hash bulk insertion - TLS peer certificate-based server-to-server authentication - New commands: LMOVEM, BLMOVEM - move multiple elements between lists - New command: SUNIONCARD - get the cardinality of the union of multiple sets - New command: SDIFFCARD - get the cardinality of the difference between sets - New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF) - XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size - New command: FT.ALIASLIST - get all aliases for the index - Stemmer support for Malay and Tagalog languages - JSONPath extensions - New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp - New command: TS.READ - optionally blocking read - New command: TS.QUERYLABELS - Get a list of labels and label-values - New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples - Performance improvements - Update to 8.8.1 Security fixes - RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution - Update to 8.8.0 - New data structure: Array (@antirez) - Subkey notification for hash fields - field-level notifications - INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team) - XNACK: a new streams command - allow consumers to explicitly release pending messages - ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator - JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays - TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command - FT.HYBRID KNN clause: new argument to request fewer candidates per shard - FT.PROFILE HYBRID: profiling support for FT.HYBRID - Performance improvements - Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166 boo#1264167 boo#1264168) - Security fixes - (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. - (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution - (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution - (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) - (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) - Bug fixes - SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788) - CONFIG SET: some settings allow invalid characters (RED-167787) - SCRIPT DEBUG: potential crash on scripts (RED-175507) - VADD: crash or buffer overflow on large REDUCE value (RED-170921) - VSET: crash on huge allocations (MOD-12678) - Potential crash on disconnections and TLS failures (Time Series) (MOD-14850) - RediSearch/RediSea

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

A security update for hostapd addresses a segmentation fault issue during fast restart cycles and a vulnerability (CVE-2025-24912) where hostapd fails to properly process crafted RADIUS packets. This vulnerability could lead to unexpected behavior or denial of service. The update fixes these issues to improve stability and security.

The perl-Crypt-SaltedHash module was updated to version 0.110.0 to address security issues including the use of a system randomness source for salt generation (CVE-2026-47372) and implementation of constant-time hash comparisons (CVE-2026-47373). These changes improve the security of password hashing by mitigating risks related to predictable salts and timing attacks. The module is now deprecated and maintenance has been taken over by a new maintainer.

Multiple security vulnerabilities were fixed in the SUSE Linux Enterprise 16.0 kernel update. These issues affect various kernel subsystems including networking, filesystems, cryptography, drivers, and architecture-specific code. The update addresses a wide range of flaws such as use-after-free, information leaks, buffer overflows, race conditions, and privilege escalation vectors. A notable issue fixed is CVE-2026-31431, where improper handling of in-place cryptographic operations in the algif_aead module could allow local privilege escalation or container escape. The update is a comprehensive security patch for the Linux kernel addressing many critical and high-severity issues.

This security update for OpenSC addresses multiple vulnerabilities including stack-buffer-overflow and out-of-bounds read issues triggered by crafted smart card or USB device responses. These flaws could cause crashes or unexpected behavior. The vulnerabilities are identified as CVE-2025-49010, CVE-2025-66037, CVE-2025-66038, and CVE-2025-66215. The severity is assessed as low based on the available information. No specific CVSS scores or detailed affected versions beyond the provided package versions are available.

A security update for editorconfig-core-c addresses a buffer overflow vulnerability identified as CVE-2026-40489. This vulnerability involves the l_pattern buffer and has been assigned a medium severity rating. The update fixes this issue to prevent potential exploitation.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP:Memory disclosure and denial of service via specially crafted PCX image (CVE-2026-4887) * gimp: GIMP: Remote Code Execution via XPM File Parsing Integer Overflow (CVE-2026-4154) * GIMP: GIMP: Arbitrary code execution via specially crafted PSD file (CVE-2026-4150) * gimp: GIMP: Remote Code Execution via PSP file parsing (CVE-2026-4153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for krb5 fixes the following issue - CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).

A security update for GraphicsMagick addresses a stack buffer overflow vulnerability in the XTileImage function identified as CVE-2026-42050. This vulnerability could potentially allow memory corruption issues. The update fixes this issue in specific SUSE package versions of GraphicsMagick.

This security update for cyrus-imapd addresses multiple issues including two notable vulnerabilities: CVE-2025-49812 related to Opportunistic TLS desynchronization attacks and CVE-2025-23394 which allows privilege escalation from the cyrus user to root via the daily-backup.sh script. The update also disables STARTTLS by default in favor of implicit TLS over a dedicated port and fixes several bugs and stability issues.

A vulnerability in strongSwan involving a double-free error when destroying certain cloned identities can lead to a crash or potential arbitrary code execution. This issue affects multiple versions of strongSwan used in various Ubuntu releases and SUSE. The vulnerability is tracked as CVE-2026-47895 and has been assigned a high severity. Official patches have been released by Ubuntu and SUSE to address this flaw.

A security update for wicked addresses an indirect remote shell command injection vulnerability via unsanitized DHCP strings and leaseinfo dump. The update fixes escaping of single-quotes in leaseinfo dump output used by wicked test commands and written to leaseinfo files, restricts allowed characters in timezone options per RFC4833, and discards string values containing single-quotes in other options. The update also triggers regeneration of initrd containing wicked binaries when upgrading from versions 0.6.78 or earlier.

A security update for the 'enc' component addresses CVE-2026-1229 by fixing an incorrect value issue. The update includes a bump of the circl library to version 1.6.3 and updates dependencies in versions 1.1.4 and 1.1.5. No specific affected versions are stated. The vulnerability is rated as high severity, but no CVSS score is provided.

This security update for OpenSSL 3 addresses multiple vulnerabilities including remote denial-of-service via expensive Diffie-Hellman key agreement computations, heap buffer overflows, out-of-bounds reads, null pointer dereferences, acceptance of forged CMS messages, and cryptographic processing errors in AES modes. These issues affect the OpenSSL 3 library and could lead to crashes, memory corruption, or cryptographic failures.

This update for xen fixes the following issues: - CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952). - CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955). - CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).

A security update for xdg-dbus-proxy addresses CVE-2026-34080, which involves a failure in the policy parser that can lead to information disclosure. The vulnerability has been assigned a medium severity level. No specific affected versions or CVSS score are provided. There is no indication of known exploits in the wild. The update fixes the issue to prevent potential information leakage.

This security update for python-Django addresses multiple vulnerabilities that could lead to exposure of private data and potential security issues in cookie handling and email transmission. The issues include signed cookie salt namespace collision, unencrypted email transmission risk via STARTTLS in the SMTP backend, and several cases of potential private data exposure due to HTTP header misconfigurations such as Cache-Control and Vary headers. These vulnerabilities have been identified and fixed in the update provided by the SUSE Product Security Team.

This security update for perl-CryptX addresses multiple issues including security and hardening fixes across various cryptographic modules. It includes fixes for CVE-2026-41564 and CVE-2026-41565, updates to cryptographic algorithms and functions, and improvements in documentation and compliance with cryptographic standards. The update is version 0.89.0 and includes bundled updates to libtomcrypt and libtommath libraries.

A security update for perl-YAML-Syck addresses CVE-2026-5089, which fixes a buffer underflow vulnerability in the base60 (sexagesimal) parsing functionality. This vulnerability could potentially lead to memory corruption issues. The update resolves this issue to prevent such underflows.