Threat database

FreeRDP versions prior to 3.31.0 contain a vulnerability where uninitialized heap memory is transmitted in reserved padding fields of the Save Session Info PDU. This occurs because certain PDU writers use Stream_Seek instead of zeroing the reserved padding bytes, potentially leaking stale heap data including cleartext credentials from previous sessions. This affects FreeRDP-based servers and proxies that forward these PDUs, allowing disclosure of server or proxy process memory to downstream clients. A security update addressing this issue is available.

A security update for suseconnect-ng has been released, updating the software to version 1.23.0. The update includes improvements such as using product identifiers for product migrations, switching the default Go version to go1.26-openssl for package building support, fixing flag parsing to properly handle unknown flags, ensuring consistent interactive/noninteractive handling during release package installation, adding an optional collector for installed SUSE vendored RPM packages, and allowing deregistration when a subscribed registration code has expired.

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.

A security update for rsyslog addresses a vulnerability in the imdtls module that allowed bypassing permitted-peer authorization. This issue could potentially allow unauthorized peers to connect despite authorization controls. The update fixes this authorization bypass to enhance security.

A security update for rsyslog addresses a vulnerability in the imdtls module that allowed bypassing permitted-peer authorization. This issue could potentially allow unauthorized peers to connect despite authorization controls. The update fixes this authorization bypass.

This update for wireshark fixes the following issues: Update to Wireshark 4.4.18: - CVE-2026-19694: TTX Logger file parser crash (bsc#1275279). - CVE-2026-19695: Gammu DCT3 trace file parser crash (bsc#1275280). - CVE-2026-19696: Ixia IxVeriWave and Vector Informatik BLF file parser crashes on Windows (bsc#1275281). - CVE-2026-76879: C12.22 protocol dissector crash (bsc#1275828). - CVE-2026-76880: RRC protocol dissector crash (bsc#1275829). - CVE-2026-76881: CMS protocol dissector crash (bsc#1275831). - CVE-2026-76882: Bluetooth Attribute Protocol dissector crash (bsc#1275832). - CVE-2026-76883: Catapult DCT2000 file parser crash (bsc#1275833). - CVE-2026-76884: ERF file parser crash (bsc#1275834). - CVE-2026-76885: Tektronix K12xx file parser crash (bsc#1275835). - CVE-2026-76886: C12.22 protocol dissector crash (bsc#1275836). - CVE-2026-76887: Dissection engine reassembly crash (bsc#1275838). - CVE-2026-76888: RDP protocol dissector crash (bsc#1275839). - CVE-2026-76889: UMTS FP protocol dissector crash (bsc#1275840). - CVE-2026-76890: Sharkd utility crash (bsc#1275841). - CVE-2026-76891: Sharkd utility crash (bsc#1275844). - CVE-2026-76917: Bluetooth AVRCP Profile (bsc#1275842). - CVE-2026-76918: SSH protocol dissector crash (bsc#1275843). - CVE-2026-76919: ESS protocol dissector crash (bsc#1275845). - CVE-2026-76920: 3gpp phone log file parser crash (bsc#1275846). - CVE-2026-76921: CMS protocol dissector crash (bsc#1275847). - CVE-2026-76922: Bluetooth BR/EDR FHS protocol dissector crash (bsc#1275848). - CVE-2026-76923: Bluetooth HFP Profile protocol dissector crash (bsc#1275849). - CVE-2026-76924: Kerberos protocol dissector crash (bsc#1275850). - CVE-2026-76926: BUSMASTER file parser abnormal exit (bsc#1275851). - CVE-2026-76927: H.245 protocol dissector crash (bsc#1275852). - CVE-2026-76928: X.509IF protocol dissector crash (bsc#1275853). - CVE-2026-76929: Pcapng file parser crash (bsc#1275854). Many more features, bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-4.4.18.html

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435). - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656). - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633). - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000). - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577). - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). - CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899). - CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825). - CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904). - CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964). - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282). - CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268). - CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263). - CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180). - CVE-2026-63826: fbdev: fix use-after-free in store_modes() (bsc#1272183). - CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176). - CVE-2026-63884: drm/i915: Fix potential UAF in TTM object purge (bsc#1272573). - CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607). - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836). - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904). - CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907). - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918). - CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855). - CVE-2026-63946: Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1272665). - CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468). - CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466). - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678). - CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694). - CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865). - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035). - CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242). - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207). - CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004). - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231). - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072). - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526). The following non security issues were fixed: - Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes). - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912). - ice: don't check has_ready_bitmap in E810 functions (bsc#1269981). - ice: factor out ice_ptp_rebuild_owner() (bsc#1269981). - ice: fix PTP Call Trace during PTP release (bsc#1269981). - ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981). - ice: introduce PTP state machine (bsc#1269981). - ice: pass reset type to PTP reset functions (bsc#1269981). - ice: rename ice_ptp_tx_cfg_intr (bsc#1269981). - ice: rename verify_cached

SUSE Linux Enterprise 15 SP6 kernel received a security update addressing multiple vulnerabilities across various kernel subsystems including networking, timers, bonding, BPF, DRM, SCSI, Bluetooth, and others. The update fixes issues such as memory leaks, use-after-free bugs, type confusion, out-of-bounds writes, and race conditions. These fixes collectively improve the security and stability of the kernel.

Multiple security issues were fixed in the yast2-users package version 5.0.9-1.1 for openSUSE Tumbleweed. These issues are tracked under CVE-2026-59680 and involve weaknesses identified by CWE-78 and CWE-1287. The vulnerabilities affect versions prior to 5.0.9 and have been addressed in the specified update.

Multiple security issues in the python3 virtual environment (venv) activation scripts and IPv6 address validation were fixed in the python313-virtualenv-21.14.2-1.1 package for openSUSE Tumbleweed and Red Hat Enterprise Linux 8. The primary vulnerabilities include improper quoting of paths in venv activation scripts (CVE-2024-9287) and improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168). These issues have been addressed in updated packages provided by SUSE and Red Hat.

This update for pcapplusplus fixes the following issues: Changes in pcapplusplus: - Update to version 26.07 * libpcap / WinPcap / Npcap is now optional. * Bumped the minimum required C++ standard to C++14 Protocol support: * Added Modbus protocol * Added DoIP - Diagnostic over Internet Protocol * Added PostgreSQL Wire Protocol (PGWire), including additional message types * Added MySQL Wire Protocol * Discrete FTPControl and FTPData protocol types * Add support for AccurateECN TCP flag * Improve SIP packet detection using heuristic parsing * Recognize LLC payload in SLL2 Added extensive X.509 / cryptography support: * X.509 certificate decoding, extension parsing, and parsing of X.509 certificates embedded in SSL/TLS messages * Export/import of X.509 certificates to PEM format, plus a new general-purpose PEM codec * Cryptographic key decoders (RSA/EC private and public keys) * Base64 encoding/decoding * A new X509Toolkit example application * Expanded ASN.1 codec support: BitString, UTCTime/GeneralizedTime, ObjectIdentifier and string records, plus arbitrary-size integer support * IFileReaderDevice::createReader() and IFileReaderDevice::tryCreateReader() use file-content heuristics to automatically pick the right reader (pcap/pcapng/snoop) instead of relying solely on the file extension * Add incremental packet parsing support with Packet::parsePacket() * Added multi-language README support: Japanese * IPv4Address/IPv6Address/MacAddress user-defined literals, e.g. constructing addresses directly from string literals, and sized buffer-construction overloads * Explicit-ownership overloads for RawPacket::setRawData(), and a sized overload for Layer::copyData() * Improved zstd support: added a build flag to control zstd support * A new SuppressLogs RAII class for temporarily suppressing log output * Large-scale internal refactoring of the device layer (PcapLiveDevice, DpdkDeviceList, file readers/writers, statistics tracking), the logging infrastructure, and the packet parsing infrastructure, improving encapsulation, thread-safety, and maintainability * Improved benchmarking: added a pure-parsing benchmark and extended benchmarks to support PcapNG and Snoop files * Test refactoring: replace packet creation macros in with C++ functions * Tons of security and correctness bug fixes Breaking changes: * The minimum required C++ standard has been raised to C++14 * IPcapDevice has been removed; its logic now lives in PcapLiveDevice * libpcap/WinPcap/Npcap is now an optional dependency - building without it disables Pcap++ capture features, though Common++/Packet++ (including pcap file I/O) remain fully usable * Various internal APIs around device lists and statistics tracking were reworked as part of the refactoring above; this may affect code relying on undocumented internals Deprecation list: * IPv6Address::copyTo() has been deprecated, please use IPv6Address::copyToNewBuffer() instead * MacAddress::copyTo() has been deprecated, please use MacAddress::copyToNewBuffer() instead * Asn1IntegerRecord::getValue() has been deprecated, please use Asn1IntegerRecord::getIntValue() instead * RawPacket::getObjectType() has been deprecated due to unclear semantics * RawPacket::setRawData() has been deprecated, please use the overload that takes takeOwnership parameter for explicit control * RawPacket::initWithRawData() has been deprecated, please use RawPacket::setRawData() with takeOwnership=false instead * SSLExtension::SSLExtension() has been deprecated, please use the constructor with bounded span instead * Several TcpOptionBuilder constructors have been deprecated, please use the new constructors with TcpOptionEnumType instead * TcpLayer::getTcpOption(TcpOptionType option) has been deprecated, please use the overload TcpLayer::getTcpOption(TcpOptionEnumType option) instead * TcpLayer::removeTcpOption(TcpOptionType optionType) has been deprecated, please use the overload TcpLayer::removeTcpOption(TcpOptionEnumType optionType) instead * MBufRawPacket::getObjectType() has been deprecated due to unclear semantics * IFileReaderDevice::getReader() has been deprecated, please use IFileReaderDevice::tryCreateReader() instead * PcapFileReaderDevice::isNanoSecondPrecisionSupported() has been deprecated, nanosecond precision is now natively supported by the internal parser and always returns true * PcapFileWriterDevice::isNanoSecondPrecisionSupported() has been deprecated, nanosecond precision is now natively supported by the internal parser and always returns true * BpfFilterWrapper::matchPacketWithFilter() has been deprecated, please use BpfFilterWrapper::matches() instead * GeneralFilter::matchPacketWithFilter() has been

A security update for wget addresses CVE-2026-16599, which involves a server-controlled unbounded MD5 loop in the FTP OPIE implementation. This vulnerability could potentially cause issues related to resource exhaustion or denial of service. The update fixes this issue in specific SUSE wget package versions.

This update for jline3 fixes the following issue: Update to upstream version 3.30.17: * Security Fixes + Native Stack Buffer Overflow in Public INPUT_RECORD.memmove JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6) + Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj) + Authenticated SSH DoS via Unbounded Window-Change Terminal Geometry (GHSA-m935-wqpj-pvp3) + TCP Socket File Descriptor Leak When Maximum Connections Reached (GHSA-c87g-867h-cqr6) * Bug Fixes + strip control characters from file names in posix builtins + bound !# history expansion to prevent exponential blowup + verify server host keys in the ssh client builtin + address remaining security vulnerabilities reported by AFINE/CERT.PL + backport security fixes from master + backport security fixes to 3.x (path traversal + DSR plain text) + strip control characters from ssh banner and prompts * Dependency updates + bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.2 + bump slf4j.version from 2.0.18 to 2.0.19 + bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 + bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 + bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.2 + bump actions/setup-java from 5 to 6.0.0 + bump org.graalvm.sdk:graal-sdk from 25.1.3 to 25.3.4.1 + bump com.mycila:license-maven-plugin from 5.0.0 to 5.1.2 + bump org.easymock:easymock from 5.6.0 to 5.7.0 + bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2 + bump org.apache.maven.wrapper:maven-wrapper from 3.3.2 to 3.3.4 + bump org.apache.maven:apache-maven from 4.0.0-rc-3 to 4.0.0-rc-6 + bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10 + bump com.palantir.javaformat:palantir-java-format from 2.96.0 to 2.97.0 + bump release-drafter/release-drafter from 7.6.0 to 7.7.0 + bump groovy.version from 4.0.32 to 4.0.33 + bump release-drafter/release-drafter from 7 to 7.6.0 + bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 - Update to upstream version 3.30.16 * bugfix release with security hardening, SSH agent forwarding fix, and terminal compatibility improvements. * Breaking Changes + SSH agent forwarding is no longer enabled by default; pass -A to explicitly request it + reject overlong hex components in OSC color responses + strip OSC and other escape sequences in ansiAppend + search multiple lib paths for versioned libutil.so + use Path.resolve instead of URI.resolve in cat and sort to prevent SSRF + check closed flag in PtyInputStream to prevent hang on empty input + confine ConfigurationPath lookups to the config directory + disable Read File command in nano restricted mode + drain buffered data before EOF in NonBlockingPumpInputStream + look up openpty in libc.so.6 for glibc 2.34+ + guard styleMatches and highlighter rules against ReDoS + backport telnet DoS mitigations (GHSA-47qp, GHSA-2r2c) + propagate EOF in PtyInputStream to avoid infinite loop + bump org.apache.ivy:ivy from 2.5.3 to 2.6.0 + bump actions/setup-node from 6 to 7 + bump com.palantir.javaformat:palantir-java-format from 2.94.0 to 2.96.0 + bump sshd.version from 2.18.0 to 2.19.0 + bump org.codehaus.gmavenplus:gmavenplus-plugin from 5.0.0 to 5.1.0 + bump org.graalvm.sdk:graal-sdk from 25.0.3 to 25.1.3 + bump com.diffplug.spotless:spotless-maven-plugin

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the caddy package to version 2.11.6-0.1.hum1. This update addresses the vulnerability identified as CVE-2026-81871. The advisory does not specify the nature of the vulnerability beyond referencing CWE-295, which relates to improper certificate validation. No explicit fix version is stated beyond the updated package version.

This security update for jline3 addresses multiple security vulnerabilities and bugs by updating to upstream version 3.30.17. The fixes include a native stack buffer overflow in a Windows JNI method, authenticated SSH resource leaks and denial-of-service issues, and TCP socket file descriptor leaks. Additional bug fixes and dependency updates are also included. SSH agent forwarding is now disabled by default as a breaking change. No CVSS score is provided, but the update mitigates several medium-severity security issues.

Multiple vulnerabilities have been identified in libpcap, including out-of-bounds memory access, division by zero, infinite loops, improper header validation, memory leaks, and process termination due to invalid instructions. These issues affect the BPF interpreter and rpcap components, potentially leading to crashes, resource exhaustion, or memory corruption.

These are all security issues fixed in the valkey-9.1.2-3.1 package on the GA media of openSUSE Tumbleweed.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This security update provides a functional equivalent of RHSA-2026:73979. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:73979.

A vulnerability in the Linux kernel's soft-iWARP implementation allows a malicious connected siw peer to send a malformed iWARP FPDU with an underflow in the MPA length field. This causes a signed integer underflow leading to a large unsigned read in kernel memory copy operations. The issue is addressed by adding a check to reject malformed FPDUs that violate protocol length constraints, terminating the connection on error.