Threat database

A security update for ImageMagick addresses multiple vulnerabilities including denial of service, integer overflows, buffer overflows, use-after-free, and missing bounds checks across various image decoders and encoders. These issues could lead to crashes, memory corruption, or unauthorized file access. The update fixes at least 18 distinct security flaws affecting different components such as MVG to SVG conversion, SIXEL decoder, morphology kernel parsing, PCL encoder, MSL decoder and encoder, MNG encoder, JBIG decoder, MAT decoder, DIB coder, PNG encoder, and others.

This security update for Vim addresses multiple vulnerabilities including arbitrary shell command execution via crafted URLs in the netrw plugin, a stack buffer overflow in the NetBeans integration, and a path traversal issue in the zip.vim plugin. The update upgrades Vim to version 9.2.0110 which includes these security fixes. Additional non-security changes include enabling Wayland support and new Swedish man pages.

Multiple remote code execution vulnerabilities have been identified in the GStreamer multimedia framework, specifically in the gstreamer-plugins-ugly package. These include heap-based buffer overflow and out-of-bounds write flaws in various demuxers such as ASF and RealMedia. The vulnerabilities allow for potential arbitrary code execution when processing crafted media files. Red Hat has issued security updates addressing these issues in Red Hat Enterprise Linux 10 and related packages.

This security update for the ucode-intel package addresses multiple medium-severity vulnerabilities in Intel CPU microcode affecting SUSE Linux Enterprise and SUSE Linux Micro 6.2 on x86_64. The issues include potential privilege escalation due to incorrect behavior in transitions between executive monitor and SMI transfer monitor, and improper handling of microcode flow values in some Intel processors. The update includes microcode releases 20260210, 20251111, and 20241029, which fix these vulnerabilities and other functional problems.

A security update for poppler addresses an infinite recursion vulnerability caused by an object loop in PDF CMap, which can lead to a stack overflow. This issue is tracked as CVE-2025-11896 and has been assigned a medium severity level. No specific affected versions or CVSS score are provided.

A security update for Mumble addresses CVE-2025-71264, an issue in the Opus codec where incorrect size calculations can cause out-of-bounds array access, potentially leading to a client crash. The update also includes fixes for undesired ACL behavior and various client bugs related to UI, memory leaks, and audio controls.

A security update for python-simpleeval addresses CVE-2026-32640, which involves dangerous modules leaking through direct access inside the sandbox. This vulnerability allows objects, including modules, to expose unsafe modules within the sandbox environment. The issue has been fixed by the SUSE Product Security Team. No specific affected versions or patch links are provided.

This security update for cosign version 3.0.5 addresses multiple vulnerabilities including improper certificate validation, path traversal allowing arbitrary file writes, SSRF via URL validation bypass, denial of service from invalid metadata, unauthorized metadata modification, sensitive information leaks in logs, and memory consumption issues. These fixes resolve issues that could lead to undefined behavior, arbitrary internal service access, denial of service, information disclosure, and acceptance of invalid verification entries. The update is provided by the SUSE Product Security Team and affects specific cosign package versions.

This security update for libjxl addresses two vulnerabilities where specially crafted files can cause the decoder to read or write pixel data from or to uninitialized memory. These issues could potentially lead to memory corruption or other unintended behavior during image decoding.

This update for net-snmp fixes the following issues: - CVE-2025-68615: Fixed snmptrapd buffer overflow (bsc#1255491).

A security update for krb5-appl addresses a critical remote pre-authentication buffer overflow vulnerability in GNU Inetutils telnetd LINEMODE, identified as CVE-2026-32746. This flaw could allow remote attackers to cause a buffer overflow before authentication. The update fixes this issue to prevent potential exploitation.

A security update for python-Django addresses CVE-2026-25674, which fixes a race condition that could lead to incorrect permissions on newly created file system objects. This vulnerability could potentially allow unauthorized access due to improper permission settings. The issue has been fixed by the vendor. No CVSS score is provided, but the impact is assessed as medium severity.

This update for ocaml fixes the following issues: - CVE-2026-28364: missing bounds validation in readblock() can lead to arbitrary code execution (bsc#1258992)

This security update for Mozilla Firefox addresses multiple vulnerabilities across various components including WebRTC, JavaScript engine, graphics, storage, DOM, audio/video, networking, and more. The issues fixed include use-after-free bugs, incorrect boundary conditions, integer overflows, sandbox escapes, privilege escalations, mitigation bypasses, and information disclosure. The update specifically mentions fixes in Firefox Extended Support Release 140.8.0 ESR and other related products. These vulnerabilities collectively pose a high risk to the security and stability of affected Firefox versions.

A security update for rust-keylime addresses a vulnerability identified as CVE-2026-25727, which involves a date parser that can lead to stack exhaustion in the Time component. This issue was fixed by updating vendored crates in version 0.2.8+116. The vulnerability is rated as high severity. No specific affected versions were provided in the available data.

This security update for QEMU addresses multiple medium severity vulnerabilities, including CVE-2025-14876, an unbounded allocation issue in virtio-crypto, and CVE-2026-0665, a PIRQ bounds check issue in xen_physdev_map_pirq. The update requires upgrading to QEMU version 10.0.8 on the aarch64 architecture. No CVSS scores are provided for these vulnerabilities.

This update for postgresql16 fixes the following issues: - Update to versio 16.13. (bsc#1258754) - CVE-2026-2003: Guard against unexpected dimensions of oidvector/int2vector (bsc#1258008) - CVE-2026-2004: Harden selectivity estimators against being attached to operators that accept unexpected data types. (bsc#1258009) - CVE-2026-2005: Fix buffer overrun in contrib/pgcrypto's PGP decryption functions. (bsc#1258010) - CVE-2026-2006: Fix inadequate validation of multibyte character lengths. (bsc#1258011)

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.