FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path (CVE-2026-26965)
* freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline (CVE-2026-26955)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231)
* kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. (CVE-2025-71238)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security update for GraphicsMagick addresses three vulnerabilities: a division-by-zero error in YUV sampling factor validation causing crashes (CVE-2026-25799), a missing bounds check in the MNG encoder leading to a stack buffer overflow (CVE-2026-28690), and a missing bounds check in PNG image encoding that can cause a heap buffer overwrite (CVE-2026-30883). These issues could lead to application crashes or memory corruption.
This update for python312 fixes the following issues:
Update to Python 3.12.13:
- CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
- CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
- CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
- CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
- CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
- CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
- CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
- CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042).
- CVE-2026-1299: header injection when an email is serialized due to improper newline quoting (bsc#1257181).
- CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).
Changelog:
- gh-144125: BytesGenerator will now refuse to serialize
(write) headers that are unsafely folded or delimited; see
verify_generated_headers. (Contributed by Bas Bloemsaat and
Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
- gh-143935: Fixed a bug in the folding of comments when
flattening an email message using a modern email policy.
Comments consisting of a very long sequence of non-foldable
characters could trigger a forced line wrap that omitted
the required leading space on the continuation line,
causing the remainder of the comment to be interpreted as
a new header field. This enabled header injection with
carefully crafted inputs (bsc#1257029 CVE-2025-11468).
- gh-143925: Reject control characters in data: URL media
types (bsc#1257046, CVE-2025-15282).
- gh-143919: Reject control characters in http.cookies.Morsel
fields and values (bsc#1257031, CVE-2026-0672).
- gh-143916: Reject C0 control characters within
wsgiref.headers.Headers fields, values, and parameters
(bsc#1257042, CVE-2026-0865).
- gh-142145: Remove quadratic behavior in xml.minidom node ID
cache clearing. In order to do this without breaking
existing users, we also add the ownerDocument attribute to
xml.dom.minidom elements and attributes created by directly
instantiating the Element or Attr class. Note that this way
of creating nodes is not supported; creator functions like
xml.dom.Document.documentElement() should be used instead
(bsc#1254997, CVE-2025-12084).
- gh-137836: Add support of the 'plaintext' element, RAWTEXT
elements 'xmp', 'iframe', 'noembed' and 'noframes', and
optionally RAWTEXT element 'noscript' in
html.parser.HTMLParser.
- gh-136063: email.message: ensure linear complexity for
legacy HTTP parameters parsing. Patch by Bndikt Tran.
- gh-136065: Fix quadratic complexity in
os.path.expandvars() (bsc#1252974, CVE-2025-6075).
- gh-119451: Fix a potential memory denial of service in the
http.client module. When connecting to a malicious server,
it could cause an arbitrary amount of memory to be
allocated. This could have led to symptoms including
a MemoryError, swapping, out of memory (OOM) killed
processes or containers, or even system crashes
(CVE-2025-13836, bsc#1254400).
- gh-119452: Fix a potential memory denial of service in the
http.server module. When a malicious user is connected to
the CGI server on Windows, it could cause an arbitrary
amount of memory to be allocated. This could have led to
symptoms including a MemoryError, swapping, out of memory
(OOM) killed processes or containers, or even system
crashes.
- gh-119342: Fix a potential memory denial of service in the
plistlib module. When reading a Plist file received from
untrusted source, it could cause an arbitrary amount of
memory to be allocated. This could have led to symptoms
including a MemoryError, swapping, out of memory (OOM)
killed processes or containers, or even system crashes
(bsc#1254401, CVE-2025-13837).
- Library
- gh-144833: Fixed a use-after-free in ssl when SSL_new()
returns NULL in newPySSLSocket(). The error was reported
via a dangling pointer after the object had already been
freed.
- gh-144363: Update bundled libexpat to 2.7.4
- gh-90949: Add SetAllocTrackerActivationThreshold() and
SetAllocTrackerMaximumAmplification() to xmlparser objects
to prevent use of disproportional amounts of dynamic memory
from within an Expat parser. Patch by Bndikt Tran.
A security update for net-tools addresses multiple stack-based buffer overflow vulnerabilities and unsafe memory operations in several components including parse_hex, proc_gen_fmt, ifconfig, ax25, and netrom. The update also improves handling of long interface names to prevent concatenation issues while maintaining compatibility. These vulnerabilities have been assigned CVE-2025-46836. The severity is assessed as medium.
A security update for fetchmail addresses a denial of service vulnerability identified as CVE-2025-61962. The update fixes this issue to prevent potential service disruption. No further technical details or exploitation methods are provided.
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 8. These include use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass issues across various components such as the JavaScript engine, graphics, audio/video, WebRTC, and networking. The update fixes these issues in Firefox ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149.
PyJWT versions prior to certain fixed releases do not validate the 'crit' (Critical) header parameter in JSON Web Signature (JWS) tokens as required by RFC 7515 §4.1.11. This allows tokens containing unknown critical extensions to be accepted instead of rejected, violating the RFC and potentially enabling security policy bypasses. The vulnerability is similar to CVE-2025-59420 affecting Authlib and has a CVSS score of 7.5 (High).
This update for python-dynaconf fixes the following issues:
Changes in python-dynaconf:
- CVE-2026-33154: Server-Side Template Injection in the @Jinja resolver (bsc#1260063)
This security update for python-ldap addresses two vulnerabilities related to character escaping in LDAP filter and distinguished name processing. Specifically, it enforces string type for escape_filter_chars and ensures NUL characters are escaped according to RFC 4514 in escape_dn_chars. These fixes prevent potential issues with improper input handling.
A security update for ffmpeg-7 addresses multiple issues including a NULL Pointer Dereference vulnerability in the ALS Decoder identified as CVE-2025-7700. The update includes version 7.1.2 which fixes compilation problems, build breaks, and other bugs. The NULL Pointer Dereference vulnerability could potentially cause application crashes or denial of service.
This security update introduces initial livepatches for the SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernels. Livepatching allows applying kernel patches without rebooting, improving system uptime and security. The update addresses vulnerabilities in these kernel versions to enhance system security.
This update for python-black fixes the following issues:
- CVE-2026-31900: a malicious pyproject.toml edit can lead to arbitrary code execution (bsc#1259546).
- CVE-2026-32274: arbitrary file writes from unsanitized user input in cache file name (bsc#1259608).
A security update for freeciv addresses multiple issues including CVE-2026-33250, a vulnerability that allows remote crashing of the server. The update also includes various bug fixes and improvements across versions 3.2.1 to 3.2.4, enhancing stability and client functionality.