Threats affecting pkg:generic/htslib

A security update for python-oauthlib addresses a privilege escalation vulnerability caused by client identity confusion in token grant handlers (CVE-2026-118669). This issue affects Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. The vulnerability allows an attacker to escalate privileges by exploiting the confusion in client identity during OAuth token grants. Red Hat has released updated packages to fix this issue.

.NET 11.0 for Red Hat Enterprise Linux contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This security issue has been addressed in an update to .NET 11.0 RC 3. The update also includes bug fixes and enhancements. The vulnerability affects multiple .NET versions including 8.0, 9.0, 10.0, and 11.0. Red Hat has released a security advisory with an important severity rating and recommends applying the update to remediate the issue.

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.

A use-after-free vulnerability exists in the Accessibility component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The vulnerability is classified with high severity by Chromium security.

Zipline versions from 4.3.2 up to but not including 4.8.0 have a rate limit bypass vulnerability. This flaw allows unauthenticated attackers to evade throttling mechanisms by spoofing the X-Forwarded-For header when the core.trustProxy setting is enabled. By sending different X-Forwarded-For values per request, attackers can bypass rate limits and perform unlimited guessing attacks against login passwords, TOTP codes, and file or URL passwords.

An information leak vulnerability exists in the Skia component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to obtain cross-origin data by crafting a malicious HTML page. The Chromium project has assigned this issue a high security severity rating.

Zipline versions 4.0.0 up to but not including 4.8.0 contain an upload filter bypass vulnerability. This flaw allows users with upload permissions to bypass administrator restrictions on blocked file types due to a mismatch in how file extensions are checked. The vulnerability arises because the upload handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, enabling bypass of file type restrictions.

A use-after-free vulnerability exists in the BrowserTag component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

Zipline versions from 4.6.2 up to but not including 4.8.0 contain a policy bypass vulnerability. Authenticated users can evade administrator-disabled MIME types by modifying file metadata via a PATCH request, allowing them to upload files with disallowed content types such as text/html. This could lead to unauthorized content being served with a disabled MIME type.

A high-severity out-of-bounds read vulnerability exists in the Skia component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker who has already compromised the renderer process to leak cross-origin data by using a specially crafted HTML page.

A vulnerability exists in the H3C ICG2000 Unified Communication Gateway 2023 in the Web Management Module, specifically in the processing of the /wnm/check.j file. This flaw can be exploited remotely to bypass authentication. The vulnerability has a medium severity score of 5.3 and an exploit has been published. The vendor has acknowledged the report but has not yet provided a fix or further response.

Zipline versions before 4.8.0 have a race condition vulnerability in the file src/server/routes/raw/[id].ts. This flaw allows remote attackers to bypass file maxViews limits by exploiting non-atomic view counting. By sending parallel requests, attackers can cause the system to read the same pre-increment view count multiple times, enabling them to view files that should be limited or deleted after a certain number of views beyond the intended limit.

A use-after-free vulnerability exists in the Layout component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A use-after-free vulnerability exists in the Passwords component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a specially crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A vulnerability in Google Chrome on Windows prior to version 157.0.8103.78 involves an uninitialized resource in the Media component. This flaw could allow a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. The issue is classified with high severity by Chromium security.

A buffer overflow vulnerability exists in the Skia component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 157.0.8103.78 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The issue is due to incomplete cleanup in V8. The Chromium security team rates this vulnerability as High severity.

A use-after-free vulnerability exists in the Compositing component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A memory corruption vulnerability exists in the V8 JavaScript engine used by Google Chrome versions prior to 157.0.8103.78. This flaw could allow a remote attacker to execute arbitrary code within the sandbox by delivering a specially crafted HTML page. The issue is classified with high severity by Chromium security.

A use-after-free vulnerability in the PDF component of Google Chrome versions prior to 157.0.8103.78 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability is classified with high severity by Chromium security.