Threats affecting pkg:generic/htslib

A missing authorization vulnerability exists in ExpressTech Quiz And Survey Master (quiz-master-next) up to version 11.3.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized users with limited privileges to perform actions beyond their intended permissions. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level with low complexity and no user interaction required.

A heap-based buffer overflow vulnerability exists in libilbm's ILBM file parsing functionality. This flaw allows remote attackers to execute arbitrary code by supplying malicious ILBM files. Exploitation requires user interaction, such as opening a crafted file or visiting a malicious page. The vulnerability arises from improper validation of user-supplied data length before copying to a heap buffer.

A local vulnerability exists in rmalright TR-VISION HOME 2.0.5 affecting the IOCTL Handler component in the WFanManager.sys library. The flaw involves incorrect default permissions due to manipulation in the sub_11504 function. This vulnerability has a high severity score and can lead to complete compromise of confidentiality, integrity, and availability if exploited. The vendor has not responded to disclosure requests, and no patch or mitigation guidance is currently available.

A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetEngine up to version 3.9.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts that execute in the context of a user's browser.

.NET 9.0 for Red Hat Enterprise Linux has multiple security vulnerabilities including information disclosure, elevation of privilege, and denial of service affecting ASP.NET Core and .NET components. These issues are addressed in an update to SDK 9.0.124 and Runtime 9.0.23. The update is rated as important by Red Hat Product Security.

Two security vulnerabilities were identified in the perl-DBI package used in Red Hat Enterprise Linux 9. The first allows loading arbitrary modules via unvalidated attributes in DBD::DBM (CVE-2026-78030). The second is a denial of service caused by an invalid memory read during numeric type casting (CVE-2026-88815). Red Hat has issued an important security update to address these issues.

A use-after-free vulnerability (CVE-2026-125704) exists in the GStreamer core buffer value deserialization component of the gstreamer1 streaming media framework. This flaw could lead to memory corruption issues. Red Hat has issued a security update for gstreamer1 in Red Hat Enterprise Linux 9 to address this vulnerability.

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 9. The update includes fixes for heap overflow, use-after-free, denial of service, and other memory corruption issues across various kernel subsystems such as USB serial, SCTP, IPv6, SMB client, and others. It also includes bug fixes and enhancements related to system stability and performance. The update is rated as having a moderate security impact and requires a system reboot to take effect.

Movable Type by Six Apart Ltd. has a code injection vulnerability in its Dynamic Publishing feature. An attacker can send a crafted request to execute arbitrary PHP code on affected versions. This vulnerability affects multiple versions of Movable Type and has a high severity rating.

SoftBank Air Terminal 6 contains an OS command injection vulnerability that could allow an attacker to execute arbitrary operating system commands on the device.

Multiple security vulnerabilities have been identified in the perl-CGI module used in Red Hat Enterprise Linux 9.8 Extended Update Support. These include a denial of service via unenforced request and upload limits, arbitrary file write through unsanitized upload filenames, and a security feature bypass via untainted request parameters. Red Hat has issued an important security advisory with updates to address these issues.

CVE-2026-114556 is a path traversal vulnerability in MailEnable version 10.59 that allows remote attackers to create arbitrary files without authentication. The flaw arises from improper validation of user-supplied paths in the Save method, potentially enabling further exploitation such as code execution with SYSTEM privileges.

CVE-2026-114558 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5. It involves an out-of-bounds write during the parsing of OPJU files, which can lead to remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction.

CVE-2026-114568 is a heap-based buffer overflow vulnerability in OriginLab Origin Viewer version 9.9.5. It occurs during the parsing of OPJ files due to improper validation of user-supplied data length before copying to a heap buffer. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and can lead to remote code execution with high impact on confidentiality, integrity, and availability.

CVE-2026-114567 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OGWU file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to memory corruption and potential code execution in the context of the current process.

CVE-2026-114566 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving improper restriction of operations within the bounds of a memory buffer during OGM file parsing. This memory corruption flaw allows remote attackers to execute arbitrary code by convincing a user to open a malicious file or visit a malicious page. Exploitation requires user interaction.

CVE-2026-114565 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OGG file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data, leading to memory corruption and potential code execution in the context of the current process.

CVE-2026-114564 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OGG file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to a write beyond the allocated memory structure.