Multiple security vulnerabilities affecting Mozilla Thunderbird were addressed in the update to version 140.10.1. These include use-after-free, uninitialized memory, information disclosure, privilege escalation, spoofing, mitigation bypass, and incorrect boundary condition issues across various components such as DOM, WebRTC, Audio/Video, Graphics, JavaScript engine, Networking, and others. Additional memory safety bugs were fixed in subsequent updates. The update also includes other bug fixes and translation improvements.
This security update for java-17-openjdk addresses multiple vulnerabilities that allow unauthenticated attackers to gain unauthorized read access to data, cause partial denial of service, or crash the system. The update upgrades to upstream tag jdk-17.0.19+10 and fixes several CVEs including CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, and CVE-2026-34282. These vulnerabilities affect various components such as JGSS, JAXP, JSSE, freetype2, and networking protocols. The update also includes other bug fixes and timezone data improvements.
This security update for python-Django addresses three vulnerabilities: a potential denial-of-service via ASGI request file upload limit bypass, session fixation through public cached pages combined with SESSION_SAVE_EVERY_REQUEST, and potential exposure of private data due to incorrect handling of Vary: * header in UpdateCacheMiddleware. These issues could impact application stability, session security, and data privacy. The update fixes these vulnerabilities to improve overall security.
A security update for curl addresses multiple vulnerabilities related to connection reuse and credential leaks. The fixed issues include improper handling of TLS requirements during connection reuse, incorrect reuse of HTTP Negotiate connections, proxy credential leaks during redirects, cookie leaks caused by stale custom cookie hosts, and netrc credential leaks with reused proxy connections. These vulnerabilities could potentially expose sensitive authentication information. The update also includes other bug fixes unrelated to security.
This security update for python3 addresses multiple vulnerabilities including incorrect tar archive parsing, HTTP proxy header validation flaws, base64 decoding issues, path traversal in resource loading, input validation bypass in cookie handling, XML parsing stack overflow, command injection via webbrowser API, and use-after-free conditions in decompression modules. These issues collectively pose risks such as misinterpretation of data, command injection, path traversal, and memory corruption.
This security update for Erlang addresses multiple vulnerabilities including remote arbitrary read/write via TFTP relative path traversal, HTTP request smuggling, path traversal, denial of service from handling highly compressed SSH data, and incorrect authorization leading to unauthenticated access to protected CGI scripts. These issues affect the SUSE distribution of Erlang and have been assigned high severity.
This security update for openexr addresses two integer overflow vulnerabilities related to pointer arithmetic in the DWA compression components. These vulnerabilities could potentially lead to memory corruption or crashes when processing certain image data.
A security update for kf6-kcoreaddons addresses a vulnerability identified as CVE-2026-41526. The issue involves improper shell argument quoting that could allow arbitrary code execution. This vulnerability has been fixed in the update provided by the SUSE Product Security Team. No specific affected versions are stated. No known exploits are reported in the wild.
A medium severity out-of-bounds memory access vulnerability (CVE-2026-40393) exists in the WebGPU component of Mesa. The vulnerability is caused by allocating memory based on untrusted input data. No specific affected versions beyond certain SUSE Mesa 24.3.3 packages are explicitly confirmed, and no patch or remediation details are provided.
A race condition vulnerability in PackageKit allows arbitrary RPM package installation as root, potentially leading to local privilege escalation (LPE). This issue is identified as CVE-2026-41651 and has been addressed by the SUSE Product Security Team.
Multiple vulnerabilities affecting Wireshark have been addressed in an update to version 4.4.15. These include memory exhaustion, illegal memory access, infinite loops, and crashes in various protocol dissectors and codecs. The update fixes issues such as missing limit and length checks in protocol dissectors that could lead to denial of service or potential code execution. The vulnerabilities affect several protocols including USB HID, RF4CE, ICMPv6, AFP, SMB2, and others. The update is available for SUSE and Red Hat Enterprise Linux 10 platforms.
The corosync packages provide the Corosync Cluster Engine and C APIs for Red Hat Enterprise Linux cluster software.
Security Fix(es):
* corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)
* corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for opencc addresses multiple issues including a specific out-of-bounds read vulnerability identified as CVE-2025-15536. The update advances the software to version 1.2.0, which also fixes crashes related to configuration file reading and additional out-of-bounds reads when processing truncated UTF-8 input. The vulnerability is rated medium severity.
Multiple NULL pointer dereference vulnerabilities have been identified and fixed in FRRouting (FRR), affecting various functions primarily in ospf_ext.c and bgpd/bgp_evpn.c components. These issues were present in versions from 4.0 through 10.5.1. The vulnerabilities could cause improper behavior or crashes when processing certain routing information.
This security update for SUSE's build and product-composer components addresses multiple improvements and fixes, including a hardening fix for CVE-2024-22038 in the export_debian_orig_from_git functionality. The update introduces new configuration options, container support enhancements, and fixes to prevent crashes and improve metadata handling. The CVE-2024-22038 fix specifically hardens the export_debian_orig_from_git tool to mitigate a security weakness.
This security update for mozjs128 addresses three vulnerabilities in the libexpat XML parsing library: a NULL pointer dereference when processing empty external parameter entities, a denial of service caused by an infinite loop in DTD content parsing, and a NULL pointer dereference in setContext after an out-of-memory condition. These issues can lead to application crashes or denial of service conditions.
This update for nginx fixes the following issues
- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled
(bsc#1260415).
- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).
- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives
are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module
(bsc#1265231).
- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`
(bsc#1265232).
- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and
`ngx_http_uwsgi_module` modules (bsc#1265233).