A vulnerability in the RelaxNG parser of libxml2 in certain SUSE packages on the aarch64 architecture allows unbounded recursion when resolving <include> directives. This can lead to call stack exhaustion and cause application crashes. The severity of this issue is assessed as medium.
Two stack-based buffer overflow vulnerabilities were found in the libsoup HTTP client and server library used by GNOME, affecting Red Hat Enterprise Linux 9.6 Extended Update Support and related packages. The first vulnerability (CVE-2026-0719) is due to a signed to unsigned conversion error in NTLM authentication. The second (CVE-2026-1761) occurs during multipart HTTP response parsing. Red Hat has issued updated libsoup packages to address these issues.
A security update for xrdp addresses a potential overflow vulnerability identified as CVE-2025-68670. This issue has been fixed by the SUSE Product Security Team. No specific affected versions are provided. The vulnerability is considered high severity based on the available information.
Wireshark 4.4.13 addresses multiple vulnerabilities including infinite loops and crashes in various protocol dissectors such as MONGO, Kafka, HTTP3, MEGACO, SSH, IEEE 802.11, BLF file parser, and SOME/IP-SD. These issues could cause denial of service conditions through application crashes or hangs. The update fixes these specific issues to improve stability and security.
This security update for glib2 addresses multiple vulnerabilities including buffer underflows, out-of-bounds accesses, and integer overflows in various components such as content type parsing, Base64 encoding, Unicode case conversion, and buffered input stream handling. These issues could lead to memory corruption or crashes. The update fixes these flaws to prevent potential exploitation.
A security update for DPDK addresses a vulnerability (CVE-2025-23259) in the Poll Mode Driver (PMD) that could allow an attacker on a virtual machine within the system to leak information and cause a denial of service on the network interface. The update advances DPDK to version 24.11.4 and also includes non-security related build improvements.
This security update addresses multiple vulnerabilities in the Linux kernel packages used by SUSE and Red Hat Enterprise Linux 9.6 Extended Update Support. The fixes include preventing opcode speculation in io_uring (CVE-2025-21863), resolving a vsock vulnerability that could lead to memory corruption (CVE-2025-40248), and correcting fragment overflow handling in the RX path of the atlantic network driver (CVE-2025-68301). The update requires a system reboot to take effect.
Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.
Security Fix(es):
* iperf3: iperf Heap Buffer Overflow (CVE-2025-54349)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418)
* urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)
* urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)
* urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update for java-25-openjdk fixes the following issues:
Update to upstream tag jdk-25.0.2+10 (January 2026 CPU)
Security fixes:
- CVE-2026-21925: Fixed Oracle Java SE component RMI (bsc#1257034).
- CVE-2026-21932: Fixed Oracle Java SE component AWT and JavaFX (bsc#1257036).
- CVE-2026-21933: Fixed Oracle Java SE component Networking (bsc#1257037).
- CVE-2026-21945: Fixed Oracle Java SE component Security (bsc#1257038).
Other fixes:
- Do not depend on update-desktop-files (jsc#PED-14507, jsc#PED-15221).
This update for udisks2 fixes the following issues:
- CVE-2025-8067: Fixed a missing bounds check that could lead to out-of-bounds
read in udisks daemon (bsc#1248502).
This security update for libsoup addresses multiple high-severity vulnerabilities including an out-of-bounds read in cookie date handling, a stack-based buffer overflow in NTLM authentication, and improper bounds handling that may allow out-of-bounds reads. These issues affect various versions of libsoup used in SUSE and Red Hat Enterprise Linux 10 distributions across multiple architectures. Patches are available from the vendors to remediate these vulnerabilities.
This security update for jasper addresses three vulnerabilities fixed in version 4.2.8. The fixes include resolving a bug in the JPC decoder that could cause bad memory accesses when debug level is high, adding missing range checks on coding parameters in the JPC encoder, and adding a check for a missing color component in the jas_image_chclrspc function. These issues could potentially lead to memory safety problems or incorrect image processing.
A security update for OpenVPN addresses CVE-2025-13086, which involves improper validation of source IP addresses that could lead to a denial of service (DoS) condition. The update fixes this vulnerability to prevent potential service disruption.