A medium severity security update for MapServer addresses multiple issues, including a fix for a potential heap buffer overflow in the msSLDParseRasterSymbolizer component. This vulnerability, identified as CVE-2026-33721, affects MapServer versions prior to 8.6.1. Updating to version 8.6.1 resolves this vulnerability along with other fixes and feature enhancements.
This update for tar fixes the following issue:
Security issue:
- CVE-2025-45582: file overwrite via directory traversal in crafted TAR archives (bsc#1246399).
Non security issue:
- Fixes tar creating invalid tarballs when used with --delete (bsc#1246607)
A security update for tigervnc addresses a vulnerability identified as CVE-2026-34352. The issue involved improper permissions that could allow unauthorized users to observe the screen or modify data sent to the client. This update fixes these permission issues to prevent such unauthorized access or modification.
This update for libpng16 fixes the following issues:
- CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code
execution (bsc#1260754).
- CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and
crashes (bsc#1260755).
A security update for osslsigncode addresses multiple vulnerabilities including integer overflows, double-free issues, and memory corruption in APPX and PE file processing. The update also includes fixes for buffer overflows during message digest extraction and improvements in certificate validation and CRL handling. These issues are fixed in osslsigncode version 2.13.
Multiple security vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP) used by the xfreerdp client. These vulnerabilities include heap-use-after-free, heap-buffer-overflow, NULL pointer dereference, denial of service, and arbitrary code execution issues. The vulnerabilities affect Red Hat Enterprise Linux 9.6 Extended Update Support and related Red Hat products. Red Hat has issued a security advisory and released updates addressing these issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180)
* kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init (CVE-2025-38248)
* kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)
* kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)
* kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)
* kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)
* kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. (CVE-2025-71238)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update for fontforge fixes the following issues:
- CVE-2025-15270: lack of proper validation of user-supplied data when parsing SFD files can lead to OOB writes and
arbitrary code execution (bsc#1256031).
This security update for dnsdist addresses two vulnerabilities: CVE-2025-8671, which introduces mitigations for the HTTP/2 MadeYouReset attack, and CVE-2025-30187, a denial of service vulnerability via crafted DNS-over-HTTPS (DoH) exchanges. The update is included in dnsdist version 1.9.11. No specific affected versions are provided. The severity of the denial of service vulnerability is rated low. There is no CVSS score available for these issues.
This update for nginx fixes the following issues:
- CVE-2026-1642: plain text data injection into the response from an upstream proxied server (bsc#1257675).
- CVE-2026-27654: buffer overflow in the NGINX worker process via the `ngx_http_dav_module module` (bsc#1260416).
- CVE-2026-27784: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260417).
- CVE-2026-28753: improper handling onf CRLF sequences in CRLF responses allows for arbitrary header injection into SMTP
upstream requests (bsc#1260418).
- CVE-2026-28755: TLS handshakes can succeed with revoked certificates due to improper handling of such certificates by
the `ngx_stream_ssl_module` module (bsc#1260419).
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)
* vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
* vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
* vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for tinyproxy addresses multiple issues including CVE-2026-3945, which fixes a denial of service vulnerability exploitable by unauthenticated remote attackers. The update also includes enhancements such as the addition of BasicAuthRealm, fixes to basic authentication error statuses, configuration documentation improvements, and a fix for an integer overflow in port number processing.
Two security vulnerabilities were fixed in the kea DHCP server software in version 3.0.3. CVE-2025-11232 addresses an assertion failure caused by invalid characters leading to hostname sanitizing issues. CVE-2026-3608 fixes a stack overflow triggered by a large number of bracket pairs in JSON payloads due to recursive parsing. These issues could cause service disruption or denial of service. The update also includes other stability and security improvements.
Two critical vulnerabilities in FreeRDP, a free implementation of the Remote Desktop Protocol, allow arbitrary code execution due to heap out-of-bounds write and heap buffer overflow in specific decode and rendering paths. These issues affect certain versions of FreeRDP included in Red Hat Enterprise Linux 9.6 Extended Update Support and related packages. Red Hat has issued security updates to address these flaws.
This security update addresses two vulnerabilities in gvfs related to FTP protocol handling: an information disclosure issue from untrusted PASV responses and an arbitrary FTP command injection via unsanitized CRLF sequences in user-supplied file paths. The update to gvfs version 1.59.90 includes fixes for these issues along with other stability and security improvements. The vulnerabilities could allow an attacker to disclose information or inject arbitrary FTP commands when interacting with FTP servers. No specific affected versions were provided in the source data. The update is part of a broader security and functionality update for gnome-online-accounts and gvfs.
This update for postgresql13 fixes the following issues:
Security fixes:
- CVE-2025-12817: Fixed missing check for CREATE privileges
on the schema in CREATE STATISTICS allowed table owners to create
statistics in any schema, potentially leading to unexpected naming
conflicts (bsc#1253332)
- CVE-2025-12818: Fixed several places in libpq were not
sufficiently careful about computing the required size of a memory
allocation. Sufficiently large inputs could cause integer overflow,
resulting in an undersized buffer, which would then lead to writing
past the end of the buffer (bsc#1253333)
Other fixes:
- Update to 13.23
* https://www.postgresql.org/about/news/p-3171/
* https://www.postgresql.org/docs/release/13.23
This security update for the expat XML parsing library addresses three vulnerabilities that can cause application crashes or denial of service. The issues include a NULL pointer dereference when processing empty external parameter entities, a denial of service from an infinite loop in DTD content parsing, and a NULL pointer dereference in the setContext function after an out-of-memory condition. These vulnerabilities have been assigned CVE identifiers CVE-2026-32776, CVE-2026-32777, and CVE-2026-32778. No specific patch or affected version details are provided in the input data.
This update for postgresql16 fixes the following issues:
- Update to versio 16.13. (bsc#1258754)
- CVE-2026-2003: Guard against unexpected dimensions of oidvector/int2vector (bsc#1258008)
- CVE-2026-2004: Harden selectivity estimators against being attached to operators that accept unexpected data types. (bsc#1258009)
- CVE-2026-2005: Fix buffer overrun in contrib/pgcrypto's PGP decryption functions. (bsc#1258010)
- CVE-2026-2006: Fix inadequate validation of multibyte character lengths. (bsc#1258011)
This security update for Tomcat 10 addresses multiple vulnerabilities including directory traversal with possible remote code execution if PUT is enabled, improper neutralization of escape sequences, denial of service via multipart upload processing, client certificate verification bypass, improper input validation on HTTP/0.9 requests, and certificate revocation bypass due to incomplete OCSP checks. The update is provided in Tomcat 10.1.52 and includes various bug fixes and improvements. The vulnerabilities affect multiple versions of Tomcat 10 and related packages as listed. The update is classified as high severity.
This security update for GraphicsMagick addresses three vulnerabilities: a division-by-zero error in YUV sampling factor validation causing crashes (CVE-2026-25799), a missing bounds check in the MNG encoder leading to a stack buffer overflow (CVE-2026-28690), and a missing bounds check in PNG image encoding that can cause a heap buffer overwrite (CVE-2026-30883). These issues could lead to application crashes or memory corruption.