Threat database

A security update for GIMP addresses a vulnerability identified as CVE-2025-15059. This update is functionally equivalent to the Red Hat advisory RHSA-2026:2930. No specific affected versions or technical details are provided in the input data.

A security update addresses multiple vulnerabilities in Node.js packages distributed by Red Hat and SUSE, including CVE-2025-55130. The update affects Red Hat Hardened Images and related Node.js RPM packages. The vulnerabilities are rated as high severity. A patch is available and has been released by Red Hat as part of their hardened images update.

CVE-2025-37882 is a race condition vulnerability in the Linux kernel's xHCI USB driver related to isochronous event handling. It can lead to data loss or use-after-free conditions. This issue is addressed by a security update from Red Hat for Enterprise Linux 9.6 Extended Update Support, which requires a system reboot. The update also fixes several other kernel vulnerabilities.

This update for fontforge fixes the following issues: Update to version 20251009. Security issues fixed: - CVE-2025-15279: remote code execution via heap-based buffer overflow in BMP file parsing (bsc#1256013). - CVE-2025-15269: remote code execution via use-after-free in SFD file parsing (bsc#1256032). - CVE-2025-15275: arbitrary code execution via SFD file parsing buffer overflow (bsc#1256025). - CVE-2025-50949: memory leak in function DlgCreate8 (bsc#1252652). Other updates and bugfixes: - fix multiple crashes in Multiple Masters. - fix crash for content over 32767 characters in GDraw multiline text field. - fix crash on Up/Down - fix crash in Metrics View. - fix UFO crash for empty contours. - fix crash issue in allmarkglyphs. - Version update to 20251009: * Update documentation for py scripts (#5180) * Update GitHub CI runners (#5328) * Update po files from Croudin sources. (#5330) * Use consistent Python in MacOS GitHub runner (#5331) * Fix CI for Windows GitHub runner (#5335) * Fix lookup flags parsing (#5338) * Fixes (#5332): glyph file names uXXXXX (#5333) * make harmonization robust and avoid zero handles after harmonization (#5262) * Quiet strict prototypes warnings. (#5313) * Fix crash in parsegvar() due to insufficient buffer (#5339) * Handle failed iconv conversion. Unhandled execution path was UB, causing a segfault for me (#5329) * Fix CMake function _get_git_version() (#5342) * Don't require individual tuple encapsulation in fontforge.font.bitmapSizes setter (#5138) * nltransform of anchor points (#5345) * Fix generateFontPostHook being called instead of generateFontPreHook (#5226) * Always set usDefaultChar to 0 (.notdef) (#5242) * add font attributes, method to Python docs (#5353) * fix segfault triggered by Python del c[i:j] (#5352) * Autoselect internal WOFF2 format (#5346) * Fix typos in the FAQ (#5355) * add font.style_set_names attribute to Python API (#5354) * Bulk tester (#5365) * Fix Splinefont shell invocation (#5367) * Fix the lists of Windows language IDs (#5359) * Support suplementary planes in SFD (emojis etc.) (#5364) * Remove psaltnames for multi-code-point names (#5305) * doc: added missing sudo to installation instructions (#5300) * Fix data corruption on SFD reading (#5380) * Compare vertical metrics check when generating TTC (#5372) * Treat FT_PIXEL_MODE_MONO as 2 grey levels (#5379) * Don't attempt to copy anchors into NULL font (#5405) * Fix export of supplementary plane characters in font name to TTF (#5396) * Defer crowdin update to the end of the pipeline (#5409) * Fix generated feature file bugs (#5384) * crowdin: update to java 17 (#5447) * Remove assert from Python script processor (#5410) * Use sysconfig for Python module locations (#5423) * Use PyConfig API on Python 3.8 (#5404) * Fix resource leak in unParseTTInstrs (#5476) * Only install GUI-specific files if ENABLE_GUI is set (#5451) * add math device tables to Python API (#5348) * Update CI runner to macOS 13 (#5482) * Allow hyphen and special characters in Feature File glyph names (#5358) * Fix Python font.appendSFNTName() function (#5494) * Update mm.c (#5386) * Warning rollup (probably some hidden bugs!) from clang trunk (#5492) * Fix function PyFFFont_addSmallCaps. (#5519) * Make SmallCaps() create symbols (#5517) * Segfault fix and complete implementation of "Don't generate FFTM tables" (#5509) * Modernize fixed pitch flag computation (#5506) * fix memleak in function utf7toutf8_copy (#5495) * Avoid crashes in Python scripts when objects are accessed in invalid state (#5483) * Fix CI for Ubuntu 24 (#5531) * Bump GitHub CI runner to Ubuntu 22 (#5551) * Fix memory corruption in SFUnicodeRanges() (#5537) * Add contour draw option to H.Metrics. (#5496) * Fix scaling of references in CharView (#5558) * Fix TTF validation on load for fixed pitch fonts (#5562) * Performance fixes for GSUB/GPOS dumps (#5547) * Simple GTK-based dialog with CSS appearance support (#5546) * Support Harfbuzz in Metrics View (#5522) * Update po files from crowdin translations (#5575) * Be more clever about label text in gtextfield (#5583) * Add minimal support for GDEF version 1.3 (#5584) * Sanitize messages from python (#5589) * Fix a crash caused by deleting a glyph with vertical kerning pairs. (#5592) * THEME -> GUI_THEME (#5596) * Update po translations from Crowdin (#5593) * Upgrade to Unicode 16.0.0 (#5594) * Fix Linux AppImage (#5599) * Upgrade to Unicode 17.0.0 and extend the language and script lists (#5618) * Remove X11 and non-Cairo drawing backends (#5612) * Add macOS dependency setup script (#5563) * Fix hotkeys in BitmapView (#5626) * Manually install Inno Setup 6 (#5621) * Remove cv->back_img_out_of_date and cv->backimgs (#5625) * fix spelling "bt" -> "but" (#5636) * Fix typos in Python module docs (#5634) - Version update to 20230101+git59.770356c9b:

A security update for openCryptoki addresses multiple high-severity vulnerabilities including CVE-2026-22791, CVE-2026-23893, and CVE-2026-40253 by upgrading to version 3.27. This update adds support for PKCS#11 v3.2 features and fixes several bugs, improving cryptographic mechanism support.

This security update for Trivy addresses multiple vulnerabilities across various dependencies including hashicorp/go-getter, golang.org/x/crypto/ssh, golang.org/x/net/html, github.com/golang-jwt/jwt, and others. The fixes cover issues such as argument injection, authorization bypass, denial of service, memory consumption, information leaks, and code execution. The update also includes other non-security related fixes and dependency upgrades. No specific affected versions of Trivy are stated in the provided data.

A security update for htmldoc addresses multiple issues including a critical buffer overflow vulnerability (CVE-2024-46478) in the parse_pre function when handling tabs. The update also fixes various regressions and bugs across versions 1.9.19 through 1.9.23, improving stability and functionality. The buffer overflow flaw could potentially allow memory corruption. No CVSS score is provided, but the severity is marked critical.

This is a security update for Rust version 1.93.0 provided by SUSE Product Security Team. The update addresses unspecified security issues in Rust 1.93.0. No detailed vulnerability or exploit information is provided in the source data.

A security update for MicroPython addresses a segmentation fault vulnerability (CVE-2026-1998) in the function mp_map_lookup triggered via mp_import_all. The update also includes various component updates and fixes unrelated to the vulnerability. No CVSS score is provided, but the issue is assessed as low severity.

This update for munge fixes the following issues: - CVE-2026-25506: buffer overflow in message unpacking (bsc#1257651). - Make `logrotate` work on log as user `munge` to prevent local privilege escalation (bsc#1246088).

This update for xorg-x11-server fixes the following issues: - CVE-2025-62229: Fixed use-after-free in XPresentNotify structures creation (bsc#1251958). - CVE-2025-62230: Fixed use-after-free in Xkb client resource removal (bsc#1251959). - CVE-2025-62231: Fixed value overflow in Xkb extension XkbSetCompatMap() (bsc#1251960).

This update for orthanc, gdcm, orthanc-authorization, orthanc-dicomweb, orthanc-gdcm, orthanc-indexer, orthanc-mysql, orthanc-neuro, orthanc-postgresql, orthanc-python, orthanc-stl, orthanc-tcia, orthanc-wsi, python-pyorthanc fixes the following issues: Changes in orthanc: - dcmtk 370 breaks TW build - switch to lua 5.4 - patch out boost component system from framework - version 1.12.10 ' long changelog - see NEWS for details - apply boost patch to source tree - Stop trying to pull libboost_system-devel in all orthanc packages. - remove libboost_system-devel for TW (removed in boost 1.89) - version 1.12.9 * long changelog - see NEWS for details Changes in gdcm: - apply fix for poppler 25.10 build error Changes in orthanc-authorization: - version 0.10.3 * New default permissions for worklists * New default permissions for tools/metrics-prometheus * New default permissions for tools/generate-uid - version 0.10.2 * New default permissions to add/delete modalities through the Rest API https://discourse.orthanc-server.org/t/managing-modalities-using-the-rest-api-and-keycloak/6137 * New standard configuration "stl" - remove libboost_system-devel for TW (removed in boost 1.89)- - version 0.10.1 * Fix audit-logs export in CSV format. * New configuration "ExtraPermissions" to ADD new permissions to the default "Permissions" entries. * Improved handling of "Anonymous" user profiles (when no auth-tokens are provided): The plugin will now request the auth-service to get an anonymous user profile even if there are no auth-tokens in the HTTP request. * The User profile can now contain a "groups" field if the auth-service provides it. * The User profile can now contain an "id" field if the auth-service provides it. * New experimental feature: audit-logs - Enabled by the "EnableAuditLogs" configuration. - Audit-logs are currently handled by the PostgreSQL plugin and can be browsed through the route /auth/audit-logs. - New default permission "audit-logs" to grant access to the "/auth/audit-logs" route. * Fix: The "server-id" field is now included in all requests sent to the auth-service. Changes in orthanc-dicomweb: - version 1.22 * framework2.diff added for compatibilty with Orthanc framework <= 1.12.10 * Fixed a possible deadlock when using "WadoRsLoaderThreadsCount" > 1 when the HTTP client disconnects while downloading the response. * Fixed "Success: Success" errors when trying to send resources synchronously to a remote DICOMweb server while the Orthanc job engine was busy with other tasks. - remove libboost_system-devel for TW (removed in boost 1.89) - version 1.21 * New configuration "WadoRsLoaderThreadsCount" to configure how many threads are loading files from the storage when answering to a WADO-RS query. A value > 1 is meaningful only if the storage is a distributed network storage (e.g object storage plugin). A value of 0 means reading and writing are performed in sequence (default behaviour). * New configuration "EnablePerformanceLogs" to display performance logs. Currently only showing the time required to execute a WADO-RS query. For example: WADO-RS: elapsed: 26106623 us, rate: 14.86 instances/s, 155.23Mbps * Fix false errors logs generated e.g when OHIF requests the /dicom-web/studies/../metadata route: "dicom-web:/Configuration.cpp:643] Unsupported return MIME type: application/dicom+json, multipart/related; type=application/octet-stream; transfer-syntax=*, will return DICOM+JSON" Changes in orthanc-gdcm: - version 1.8 * Prevent transcoding of DICOM images with empty SharedFunctionalGroupsSequence (5200,9229), as this might crash GDCM. * The built-in Orthanc transcoder being usually more stable, the default value of the "RestrictTransferSyntaxes" configuration has been updated to configure the GDCM plugin for J2K transfer syntaxes only since these transfer syntaxes are currently not supported by the built-in Orthanc transcoder. - If "RestrictTransferSyntaxes" is not specified in your configuration, it is now equivalent to "RestrictTransferSyntaxes" : [ "1.2.840.10008.1.2.4.90", // JPEG 2000 Image Compression (Lossless Only) "1.2.840.10008.1.2.4.91", // JPEG 2000 Image Compression "1.2.840.10008.1.2.4.92", // JPEG 2000 Part 2 Multicomponent Image Compression (Lossless Only) "1.2.840.10008.1.2.4.93" // JPEG 2000 Part 2 Multicomponent Image Compression ] which was the recommended configuration. - If "RestrictTransferSyntaxes" is defined but empty, the GDCM plugin will now be used to transcode ALL transfer syntaxes (this was the default behaviour up to version 1.7) - remove libboost_system-devel for TW (removed in boost 1.89) - version 1.7 * Upgrade to GDCM 3.0.24 for static builds. Fixes: - CVE-2024-22373: https://nvd.nist.gov/vuln

Multiple security vulnerabilities affecting the Linux kernel in Red Hat Enterprise Linux 9.6 Extended Update Support and related products have been addressed in a security update. The issues include buffer overflows, use-after-free, out-of-bounds reads and writes, and information disclosure in various kernel subsystems such as NFS, Bluetooth, RDMA, SMB client, and font glyph handling. These vulnerabilities have a moderate security impact and require a system reboot after patching to take effect.

This update for python313 fixes the following issues: - Update to 3.13.11: - Security - CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997) - CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400) - CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401) - CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) not checked by the 'zipfile' module (bsc#1251305) - gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser. - gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran. - CVE-2025-6075: Fixed performance issues caused by user-controller os.path.expandvars() (bsc#1252974) - Library - gh-140797: Revert changes to the undocumented re.Scanner class. Capturing groups are still allowed for backward compatibility, although using them can lead to incorrect result. They will be forbidden in future Python versions. - gh-142206: The resource tracker in the multiprocessing module now uses the original communication protocol, as in Python 3.14.0 and below, by default. This avoids issues with upgrading Python while it is running. (Note that such ‘in-place’ upgrades are not tested.) The tracker remains compatible with subprocesses that use new protocol (that is, subprocesses using Python 3.13.10, 3.14.1 and 3.15). - Core and Builtins - gh-142218: Fix crash when inserting into a split table dictionary with a non str key that matches an existing key. - Update to 3.13.10: - Tools/Demos - gh-141442: The iOS testbed now correctly handles test arguments that contain spaces. - Tests - gh-140482: Preserve and restore the state of stty echo as part of the test environment. - gh-140082: Update python -m test to set FORCE_COLOR=1 when being run with color enabled so that unittest which is run by it with redirected output will output in color. - gh-136442: Use exitcode 1 instead of 5 if unittest.TestCase.setUpClass() raises an exception - Library - gh-74389: When the stdin being used by a subprocess.Popen instance is closed, this is now ignored in subprocess.Popen.communicate() instead of leaving the class in an inconsistent state. - gh-87512: Fix subprocess.Popen.communicate() timeout handling on Windows when writing large input. Previously, the timeout was ignored during stdin writing, causing the method to block indefinitely if the child process did not consume input quickly. The stdin write is now performed in a background thread, allowing the timeout to be properly enforced. - gh-141473: When subprocess.Popen.communicate() was called with input and a timeout and is called for a second time after a TimeoutExpired exception before the process has died, it should no longer hang. - gh-59000: Fix pdb breakpoint resolution for class methods when the module defining the class is not imported. - gh-141570: Support file-like object raising OSError from fileno() in color detection (_colorize.can_colorize()). This can occur when sys.stdout is redirected. - gh-141659: Fix bad file descriptor errors from _posixsubprocess on AIX. - gh-141497: ipaddress: ensure that the methods IPv4Network.hosts() and IPv6Network.hosts() always return an iterator. - gh-140938: The statistics.stdev() and statistics.pstdev() functions now raise a ValueError when the input contains an infinity or a NaN. - gh-124111: Updated Tcl threading configuration in _tkinter to assume that threads are always available in Tcl 9 and later. - gh-137109: The os.fork and related forking APIs will no longer warn in the common case where Linux or macOS platform APIs return the number of threads in a process and find the answer to be 1 even when a os.register_at_fork() after_in_parent= callback (re)starts a thread. - gh-141314: Fix assertion failure in io.TextIOWrapper.tell() when reading files with standalone carriage return (\r) line endings. - gh-141311: Fix assertion failure in io.BytesIO.readinto() and undefined behavior arising when read position is above capcity in io.BytesIO. - gh-141141: Fix a thread safety issue with base64.b85decode(). Contributed by Benel Tayar. - gh-140911: collections: Ensure that the methods UserString.rindex() and UserString.index() accept collections.UserString instances as the sub argument. - gh-140797: The undocumented re.Scanner class now forbids regular expressions containing capturing

A security update for python-Django addresses multiple vulnerabilities including several potential SQL injection flaws, denial-of-service issues, and a username enumeration weakness. The fixes cover injection risks via QuerySet.order_by, FilteredRelation, column aliases with control characters, and raster lookups on PostGIS. Additionally, denial-of-service vulnerabilities in HTML truncation methods and ASGI repeated headers are resolved. A timing-based username enumeration in the mod_wsgi authentication handler is also fixed. These issues were identified and patched by the SUSE Product Security Team.

This security update for libsoup addresses two vulnerabilities: CVE-2026-1536, an HTTP header injection or response splitting issue via CRLF injection in the Content-Disposition header, and CVE-2026-1761, a stack-based buffer overflow caused by incorrect length calculation when parsing multipart HTTP responses. Both vulnerabilities have been fixed in the update.

A security update for python-maturin addresses CVE-2025-58160, which involves log pollution in the tracing-subscriber component. The update fixes this issue in specific SUSE package versions for aarch64 and ppc64le architectures. No CVSS score is provided, but the severity is assessed as medium.