This security update for Tor addresses multiple major bugfixes related to compression, security, client stability, and memory safety. Key fixes include resolving a compression bomb bypass, preventing infinite loops during decompression of truncated streams, fixing use-after-free and NULL pointer dereference issues, and avoiding out-of-bounds reads/writes when parsing signatures. Additional fixes improve client stability against malicious onion services, prevent crashes related to DNSPort requests, and address potential divide-by-zero crashes in onion services with proof-of-work enabled. These fixes cover bugs introduced in various alpha versions dating back to 0.2.0.1-alpha and up to 0.4.8.1-alpha. The update is part of Tor version 0.4.9.9.
A security update for vorbis-tools addresses a buffer underflow vulnerability in the ogg123 utility's remotethread function. This flaw could potentially lead to unexpected behavior or crashes when processing certain inputs. The issue is identified as CVE-2026-34253 and has been fixed by the vendor.
This update for memcached fixes the following issues
- CVE-2026-47783: timing side-channel in SASL password database authentication (username) (bsc#1265873).
- CVE-2026-47784: timing side-channel in SASL password database authentication (password) (bsc#1265881).
This security update for SUSE's ovmf product addresses multiple vulnerabilities in the mbedtls library, including a buffer overflow, improper acceptance of server-chosen signature algorithms, lack of pseudo-random number generator reseeding when cloning applications, and a NULL pointer dereference during distinguished name parsing. These vulnerabilities have been assigned CVE identifiers CVE-2026-25833, CVE-2026-25834, CVE-2026-25835, and CVE-2026-34874. The update fixes these issues to improve security.
A security update for sdbootutil addresses a vulnerability identified as CVE-2026-25701, which involves the use of a fixed directory (/tmp/pcrlock.d.back) in the sdbootutil-update-predictions.service. This update also includes multiple non-security fixes related to TPM encryption auto-unlock, systemd-boot installation issues, and other functional improvements.
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
A security update for python-PyMuPDF addresses a vulnerability identified as CVE-2026-3029. This flaw involves path traversal and arbitrary file write via the embedded_get function in the _main_.py module. The issue has been fixed in this update. No specific affected versions are provided. The vulnerability is rated as high severity.
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261845).
- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261630).
- CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for MapServer addresses an out-of-bounds access vulnerability in the SLD parser. The issue occurs when an SLD contains only a Rule with an ElseFilter but lacks a symbolizer. This vulnerability is identified by CVE-2026-33721 and CVE-2026-45104 and is fixed in release 8.6.3.
This security update for ffmpeg-4 addresses multiple vulnerabilities including a potential NULL pointer dereference and issues in audio and video codec processing. The update includes fixes for CVE-2025-10256, CVE-2025-1594, and CVE-2025-9951, improving stability and security in memory allocation and codec filter operations.
This security update for python-uv addresses two vulnerabilities: CVE-2026-31812, a denial of service issue in quinn-proto triggered by crafted QUIC initial packets, and CVE-2026-32766, where malformed PAX extensions in astral-tokio-tar can cause archive misinterpretation. Both issues have been publicly disclosed but no CVSS scores are provided. The vulnerabilities are rated medium severity based on the described impact.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security update for PuTTY version 0.84 addresses multiple vulnerabilities including remotely triggerable double-free and crash issues in cryptographic operations, as well as a potential proxy authentication spoofing risk. Additional improvements include new features and bug fixes unrelated to security. The update fixes critical memory corruption and authentication issues that could be exploited remotely.
A security update for csync2 addresses CVE-2026-41051, which involves the use of insecure temporary directories when the software is compiled with C99 or later standards. This vulnerability affects specific SUSE versions of csync2 on aarch64 and i586 architectures. The issue could potentially lead to security risks related to temporary file handling. The severity is assessed as medium. No known exploits are reported in the wild. A patch or update has been issued by the SUSE Product Security Team to fix this vulnerability.
Multiple vulnerabilities in perl-Net-CIDR-Lite can lead to IP ACL bypass due to improper validation of IP address formats and CIDR mask values. These include issues with trailing newlines or non-ASCII digits, extraneous leading zeros in CIDR masks, missing validation of IPv6 group counts, and mishandling of IPv4 mapped IPv6 addresses. The vulnerabilities affect SUSE Linux Enterprise Module for Development Tools 15 SP7 and related versions. No known exploits are reported in the wild. A security update addressing these issues has been released by the SUSE Product Security Team.
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.
Security Fix(es):
* libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)
* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:
Changes in apache-commons-lang3:
Update to 3.20.0
* New features:
+ Add SystemProperties.getPath(String, Supplier<Path>)
+ Add JavaVersion.JAVA_25
+ Add JavaVersion.JAVA_26
+ Add SystemUtils.IS_JAVA_25
+ Add SystemUtils.IS_JAVA_26
+ Add MutablePair.ofNonNull(Map.Entry)
+ Add TimedSemaphore.builder(), Builder, and deprecate
constructors
+ LANG-1504: Adding labels and history to split StopWatch
* Fixed Bugs:
+ Optimize ObjectToStringComparator.compare() method
+ [javadoc] Improve StringUtils Javadoc
+ Fix internal inverted logic in private isEnum() method and
correct its usage in getFirstEnum()
+ Use accessors in ToStringStyle so subclasses can effectively
override them
+ 'LocaleUtils.toLocale(String)' for a 2 letter country code
now returns a value instead of throwing an
'IllegalArgumentException'
+ Fix typo in StringUtils.trunctate() IllegalArgumentException
message and test assertion messages
+ Fix test fixture in
ReflectionDiffBuilderTest.testTransientFieldDifference()
+ LANG-1789: NullPointerException when generating
NoSuchMethodException in MethodUtils
+ LANG-1786: Map deprecated TimeZone short IDs and avoid JRE
WARNINGs to the console
+ LANG-1792: TypeUtils.toString() skips angle brackets for Class
type
+ Mention JDK 25 LTS as a tested version in the release notes
* Changes:
+ Bump org.apache.commons:commons-parent from 88 to 92
- Update to 3.19.0
* New features:
+ Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
+ Add SystemUtils.IS_OS_NETWARE
+ Add MethodUtils.getAccessibleMethod(Class, Method)
+ Add documentation to site for CVE-2025-48924
ClassUtils.getClass(...) can throw a StackOverflowError on
very long inputs
+ Add StringUtils.indexOfAny(CharSequence, int, char...)
+ Add ConcurrentException.ConcurrentException(String)
+ Add DateUtils.toLocalDateTime(Date[, TimeZone])
+ Add DateUtils.toOffsetDateTime(Date[, TimeZone])
+ Add DateUtils.toZonedDateTime(Date[, TimeZone])
+ Add ByteConsumer
+ Add ByteSupplier
+ Add FailableByteConsumer
+ Add FailableByteSupplier
+ LANG-1784: Add Functions methods for null-safe mapping and
chaining
+ LANG-1784: Add Failable methods for null-safe mapping and
chaining
+ Add DoubleRange.fit(double)
+ Add IntegerRange.fit(int)
+ Add LongRange.fit(long)
+ Add DurationUtils.get(String, TemporalUnit, long)
+ Add DurationUtils.getMillis(String, long)
+ Add DurationUtils.getSeconds(String, long)
+ Add SystemProperties.getBoolean(Class, String, boolean)
+ Add SystemProperties.getInt(Class, String, int)
+ Add SystemProperties.getLong(Class, String, long)
* Fixed Bugs:
+ LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the
hierarchy of methods
+ MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now
returns null instead of throwing a NullPointerException, as it
does for other exception types
+ Reduce spurious failures in ArrayUtilsTest methods that test
ArrayUtils.shuffle() methods
+ MethodUtils cannot find or invoke a public method on a public
class implemented in its package-private superclass
+ AtomicSafeInitializer.get() can spin internally if the
FailableSupplier given to AbstractConcurrentInitializer
.AbstractBuilder.setInitializer(FailableSupplier) throws a
RuntimeException
+ LANG-1783: WordUtils.containsAllWords?() may throw
PatternSyntaxException
+ LANG-1782: MethodUtils cannot find or invoke vararg methods
without providing vararg types or values
+ MethodUtils cannot find or invoke vararg methods of interface
types
+ MethodUtils cannot find or invoke vararg methods when widening
primitive types following the JLS 5.1.2. Widening Primitive
Conversion
+ LANG-1597: Invocation fails because matching varargs method
found but then discarded
+ Don't check accessibility twice in MemberUtils
.setAccessibleWorkaround(T)
+ LANG-1774: Improve handling of ClassUtils
.getShortCanonicalName() for invalid input
+ LANG-1720: Improve Javadocs for Conversion
+ Fix CalendarUtils.toLocalDate() Javadoc return type
description
+ Fix the method name in Javadoc examples for CharUtils.isHex()
+ Deprecate NumberUtils.compare(byte, byte) in favor of
Byte.compare(byte, byte)
+ Deprecate NumberUtils.compare(int, int) in favor of
Integer.compare(int, int)
+ Deprecate NumberUtils.compare(long, long) in favor of
Long.compare(long, long)
+ Deprecate NumberUtils.compare(short, short) in favor of
Short.compare(short, short)
+ Deprecate obsolete sys
A security update for openjpeg2 addresses CVE-2025-54874, a vulnerability involving a missing error check that can lead to the use of an uninitialized pointer and cause an out-of-bounds heap memory write. This issue affects openjpeg2 as packaged in Red Hat Enterprise Linux 10 and related distributions. The vulnerability has been rated as high severity by the vendor. A patch is available and should be applied to affected systems to mitigate the risk.