Red Hat has issued a security advisory for the unbound DNS resolver packages addressing two vulnerabilities: CVE-2024-33655 (DNSBomb) and CVE-2025-11411 (domain hijacking via promiscuous records). These vulnerabilities affect Red Hat Enterprise Linux 9 versions from 9.0.0 up to and including 9.8 across multiple architectures. The update is rated as having a moderate security impact. Red Hat provides updated packages to fix these issues and recommends applying the update as detailed in their advisory.
Multiple security vulnerabilities have been identified in various GStreamer plugin packages used in Red Hat Enterprise Linux 9 and related distributions. These vulnerabilities include arbitrary code execution and remote code execution via heap-based buffer overflows, integer overflows, and out-of-bounds writes in components handling ASF, JPEG, AVI, RTP, RealMedia, and DVB subtitle media formats. The issues affect the gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free packages. Red Hat has released security updates addressing these vulnerabilities. Users of affected Red Hat Enterprise Linux 9 variants and CodeReady Linux Builder should apply the updates as per the vendor advisory.
LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).
Security Fix(es):
* LibRaw: LibRaw: Arbitrary code execution via a specially crafted malicious file (CVE-2026-24450)
* LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading (CVE-2026-21413)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified in webkit2gtk3, the GTK port of the WebKit rendering engine, affecting Red Hat Enterprise Linux 9. These issues include crashes, denial-of-service, information disclosure, same-origin policy bypass, content security policy bypass, user fingerprinting, and cross-site scripting attacks triggered by processing maliciously crafted web content or websites. The vulnerabilities have been rated with high severity by Red Hat Product Security. An update is available to address these issues in Red Hat Enterprise Linux 9 and related variants.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)
* firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)
* firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)
* firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The SUSE Linux Enterprise 16.0 kernel was updated to fix one issue
The following non security issue was fixed:
- CVE-2026-46333: Fixed logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).
This update for valkey fixes the following issues
- CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts
(bsc#1258746).
- CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).
- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).
- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution
(bsc#1264165).
- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote
code execution (bsc#1264166).
Changes for valkey:
- Update to 8.0.9.
- Update to 8.0.7:
* Fix ltrim should not call signalModifiedKey when no elements are removed (#2787)
* Fix chained replica crash when doing dual channel replication (#2983)
* Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
* Avoids crash during MODULE UNLOAD when ACL rules reference a module command and
subcommand (#3160)
* Fix server assert on ACL LOAD and resetchannels (#3182)
* Fix bug causing no response flush sometimes when IO threads are busy (#3205)
This update for python-GitPython fixes the following issues
- CVE-2026-42215: command injection via Git options bypass (bsc#1264604).
- CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605).
- CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the
repository (bsc#1264606).
- CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).
This security update for the Trivy tool addresses multiple vulnerabilities across various third-party dependencies, including denial of service, open redirect, improper data integrity verification, authorization bypass, directory traversal, and credential leakage issues. The update includes upgrading the go-git dependency to version 5.18.0 and Trivy itself to version 0.70.0.
This update for emacs fixes the following issue:
- CVE-2026-6861: memory corruption when processing specially crafted SVG CSS data (bsc#1262611).
- Build with tree-sitter-0.26.8 security update (bsc#1262007).
This security update for alloy addresses multiple vulnerabilities including improper validation and verification issues in several dependencies, which could lead to crashes, consumption of corrupted files, invalid cryptographic results, and authorization bypass. The update also includes a non-security fix updating to version 1.16.0 and systemd tmpfiles.d usage for directory creation.
A security update for the ibus-rime and librime packages addresses issues related to the build against the current opencc version. No specific vulnerability details or affected versions are provided.
This security update for tree-sitter addresses multiple vulnerabilities in the wasmtime component, including out-of-bound reads, denial of service conditions, data leakage, and potential sandbox escapes. The update to tree-sitter version 0.26.8 includes fixes and improvements unrelated to security issues. The vulnerabilities are high severity and affect specific SUSE package versions.
A security update for ffmpeg-4 addresses a vulnerability identified as CVE-2026-40962. The issue involves inadequate bounds checks in CENC subsample processing that could lead to an integer overflow. This flaw has been fixed in the update provided by the SUSE Product Security Team. No specific affected versions are listed, and no CVSS score is available. The severity is assessed as medium based on the nature of the vulnerability.
This update for kdenlive fixes the following issues:
Changes in kdenlive:
- CVE-2026-45184: Fixed a remote code execution through opening a malicious project file (boo#1264711).
A heap buffer overflow vulnerability (CVE-2026-31853) exists in the SFW decoder of ImageMagick on 32-bit systems when processing extremely large images. This flaw can cause the application to crash. The issue is addressed by a security update from the SUSE Product Security Team.