This security update for exiv2 addresses multiple vulnerabilities including out-of-bounds reads, denial of service, heap buffer overflow, integer overflow, and performance degradation issues. The update corresponds to exiv2 version 0.28.8 and fixes several CVEs ranging from 2024 to 2026. These vulnerabilities affect various components such as QuickTimeVideo, AsfVideo, EpsImage, ICC profile parsing, CrwMap, and LoaderNative. The issues could lead to crashes, memory corruption, or denial of service when processing crafted image or video files.
Multiple remote code execution vulnerabilities have been identified in GIMP affecting its parsing of PGM, XWD, and ICO image file formats. These vulnerabilities involve uninitialized memory usage, out-of-bounds writes, and parsing flaws that could allow remote attackers to execute arbitrary code. Red Hat has issued a security update for GIMP in Red Hat Enterprise Linux 9.6 Extended Update Support to address these issues.
This update for harfbuzz fixes the following issues:
Update to version 11.4.5:
Security fixes:
- CVE-2026-22693: Fixed a NULL pointer dereference in SubtableUnicodesCache::create (bsc#1256459).
Other fixes:
- Bug fixes for “AAT” shaping, and other shaping micro
optimizations.
- Fix a shaping regression affecting mark glyphs in certain
fonts.
- Fix pruning of mark filtering sets when subsetting fonts, which
caused changes in shaping behaviour.
- Make shaping fail much faster for certain malformed fonts
(e.g., those that trigger infinite recursion).
- Fix undefined behaviour introduced in 11.4.2.
- Fix detection of the “Cambria Math” font when fonts are scaled,
so the workaround for the bad MATH table constant is applied.
- Various performance and memory usage improvements.
- The hb-shape command line tool can now be built with the
amalgamated harfbuzz.cc source.
- Fix regression in handling version 2 of avar table.
- Increase various buffer length limits for better handling of
fonts that generate huge number of glyphs per codepoint (e.g.
Noto Sans Duployan).
- Improvements to the harfrust shaper for more accurate testing.
- Fix clang compiler warnings.
- General shaping and subsetting speedups.
- Fix in Graphite shaping backend when glyph advances became
negative.
- Subsetting improvements, pruning empty mark-attachment lookups.
- Don't use the macro name _S, which is reserved by system
liberaries.
- Build fixes and speedup.
- Add a kbts shaping backend that calls into the kb_text_shape
single-header shaping library. This is purely for testing and
performance evaluation and we do NOT recommend using it for any
other purposes.
- Fix bug in vertical shaping of fonts without the vmtx table.
- Fix build with non-compliant C++11 compilers that don't
recognize the "and" keyword.
- Fix crasher in the glyph_v_origin function introduced in
11.3.0.
- Speed up handling fonts with very large number of variations.
- Speed up getting horizontal and vertical glyph advances by up
to 24%.
- Significantly speed up vertical text shaping.
- Various documentation improvements.
- Various build improvements.
- Various subsetting improvements.
- Various improvements to Rust font functions (fontations
integration) and shaper (HarfRust integration).
- Rename harfruzz option and shaper to harfrust following
upstream rename.
- Implement hb_face_reference_blob() for DirectWrite font
functions.
- Various build improvements.
- Fix build with HB_NO_DRAW and HB_NO_PAINT.
- Add an optional harfruzz shaper that uses HarfRuzz; an ongoing
Rust port of HarfBuzz shaping. This shaper is mainly used for
testing the output of the Rust implementation.
- Fix regression that caused applying unsafe_to_break() to the
whole buffer to be ignored.
- Update USE data files.
- Fix getting advances of out-of-rage glyph indices in
DirectWrite font functions.
- Painting of COLRv1 fonts without clip boxes is now about 10
times faster.
- Synthetic bold/slant of a sub font is now respected, instead of
using the parent’s.
- Glyph extents for fonts synthetic bold/slant are now accurately
calculated.
- Various build fixes.
- Include bidi mirroring variants of the requested codepoints
when subsetting. The new HB_SUBSET_FLAGS_NO_BIDI_CLOSURE can be
used to disable this behaviour.
- Various bug fixes.
- Various build fixes and improvements.
- Various test suite improvements.
- The change in version 10.3.0 to apply “trak” table tracking
values to glyph advances directly has been reverted as it
required every font functions implementation to handle it,
which breaks existing custom font functions. Tracking is
instead back to being applied during shaping.
- When directwrite integration is enabled, we now link to
dwrite.dll instead of dynamically loading it.
- A new experimental APIs for getting raw “CFF” and “CFF2”
CharStrings.
- We now provide manpages for the various command line utilities.
Building manpages requires “help2man” and will be skipped if it
is not present.
- The command line utilities now set different return value for
different kinds of failures. Details are provided in the
manpages.
- Various fixes and improvements to fontations font functions.
- All shaping operations using the ot shaper have become memory
allocation-free.
- Glyph extents returned by hb-ot and hb-ft font functions are
now rounded in stead of flooring/ceiling them, which also
matches what other font libraries do.
- Fix “AAT” deleted glyph marks interfering with fallback mark
positioning.
- Glyph outlines emboldening have been moved out of hb-ot and
hb-ft font functions to the HarfBuzz font layer, so that it
works with any font functions implementation.
- Fix our fallback C++11 atomics integration, which s
A security update for python-orjson addresses CVE-2025-67221, which fixes an issue involving writing outside of allocated memory during JSON dump operations. This vulnerability could potentially lead to memory corruption. The update resolves this issue to prevent such unsafe memory writes.
This update for python-tornado6 fixes the following issues:
- CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).
- incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes
(bsc#1259630).
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
A security update for ImageMagick addresses multiple vulnerabilities including denial of service, integer overflows, buffer overflows, use-after-free, and missing bounds checks across various image decoders and encoders. These issues could lead to crashes, memory corruption, or unauthorized file access. The update fixes at least 18 distinct security flaws affecting different components such as MVG to SVG conversion, SIXEL decoder, morphology kernel parsing, PCL encoder, MSL decoder and encoder, MNG encoder, JBIG decoder, MAT decoder, DIB coder, PNG encoder, and others.
This update for vim fixes the following issues:
- Update Vim to version 9.2.0110 that includes security fixes for:
* CVE-2026-28417: crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
* CVE-2026-26269: stack buffer overflow in Vim's NetBeans integration when processing the specialKeys command (bsc#1258229).
* CVE-2025-53906: path traversal in Vim's zip.vim plugin (bsc#1246602).
- Other changes:
* Add wayland-client to BuildRequires and enable Wayland support.
* Add Wayland include path to CFLAGS to fix clipboard compilation.
* Package new Swedish (sv) man pages and clean up duplicate encodings (sv.ISO8859-1 and sv.UTF-8).
This update for ucode-intel fixes the following issues:
- Intel CPU Microcode was updated to the 20260210 release (bsc#1258046):
- CVE-2024-24853: Updated fix for incorrect behavior order in transition
between executive monitor and SMI transfer monitor (STM) in some Intel(R)
Processor may allow a privileged user to potentially enable escalation
of privilege via local access (bsc#1229129).
- CVE-2025-31648: Improper handling of values in the
microcode flow for some Intel Processor Family may allow
an escalation of privilege (bsc#1258046).
- Intel CPU Microcode was updated to the 20251111 release (bsc#1253319):
- Update for functional issues.
- switch the supplements to use supplements + kernel to allow
moving a installation to Intel hardware (bsc#1249138)
- Intel CPU Microcode was updated to the 20241029 release (bsc#1230400):
- Update for functional issues.
This update for libsodium fixes the following issues:
- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
A security update for poppler addresses an infinite recursion vulnerability caused by an object loop in PDF CMap, which can lead to a stack overflow. This issue is tracked as CVE-2025-11896 and has been assigned a medium severity level. No specific affected versions or CVSS score are provided.
This update for librsvg fixes the following issues:
Update to version 2.60.2:
- CVE-2024-12224: Fixed idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243867).
- CVE-2024-43806: Fixed memory explosion in rustix (bsc#1229950).
A security update for Mumble addresses CVE-2025-71264, an issue in the Opus codec where incorrect size calculations can cause out-of-bounds array access, potentially leading to a client crash. The update also includes fixes for undesired ACL behavior and various client bugs related to UI, memory leaks, and audio controls.
This update for python-Authlib fixes the following issues:
Changes in python-Authlib:
- CVE-2026-27962: JWS `deserialize_compact()` allows for signature bypass by
accepting user-controlled embedded JWK as verification key (bsc#1259738)
- CVE-2026-28490: cryptographic padding oracle in JWE RSA1_5 key management
algorithm (bsc#1259736)
- CVE-2026-28498: fail-open in behavior OIDC hash validation allows for bypass
mandatory integrity protections (bsc#1259737)
A security update for python-simpleeval addresses CVE-2026-32640, which involves dangerous modules leaking through direct access inside the sandbox. This vulnerability allows objects, including modules, to expose unsafe modules within the sandbox environment. The issue has been fixed by the SUSE Product Security Team. No specific affected versions or patch links are provided.
This security update for libjxl addresses two vulnerabilities where specially crafted files can cause the decoder to read or write pixel data from or to uninitialized memory. These issues could potentially lead to memory corruption or other unintended behavior during image decoding.
A security update for krb5-appl addresses a critical remote pre-authentication buffer overflow vulnerability in GNU Inetutils telnetd LINEMODE, identified as CVE-2026-32746. This flaw could allow remote attackers to cause a buffer overflow before authentication. The update fixes this issue to prevent potential exploitation.