This security update for gpg2 addresses multiple vulnerabilities including a stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (CVE-2026-24882), a denial of service caused by long signature packet length (CVE-2026-24883), and acceptance of path separators and path traversals in the literal data filename field. These vulnerabilities could allow arbitrary code execution or denial of service. The update is rated as important by Red Hat and fixes these issues in Red Hat Enterprise Linux 10 and related variants. A security update is available and should be applied.
This security update addresses multiple vulnerabilities in the SUSE elemental-register and elemental-toolkit components by updating to elemental-register 1.8.1 and elemental-toolkit 2.3.2. The updates include bumps to dependencies such as github.com/rancher-sandbox/go-tpm and golang.org/x/crypto, which fix several CVEs including CVE-2025-22872, CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, and CVE-2025-58190. No specific affected versions are provided. No CVSS score is available, but the severity is assessed as high.
An update to cloud-init version 25.1.3 addresses multiple issues including fixes for vulnerabilities CVE-2024-6174 and CVE-2024-11584. The update also removes an unnecessary test dependency and corrects a dependency replacement. No specific affected versions prior to this update are stated. The vulnerabilities are rated as high severity but no CVSS score is provided.
This security update for the ucode-amd package addresses multiple updates to AMD CPU microcode and related firmware files. The updates include several revisions to the AMD CPU microcode and corrections to documentation regarding minimum revisions. No specific vulnerability details or exploitation methods are provided. The update is classified as high severity based on the vendor's assessment.
A security update for python-h2 addresses CVE-2025-57804, which is an HTTP Request Smuggling vulnerability caused by illegal characters in headers. This vulnerability has been fixed by the SUSE Product Security Team. No specific affected versions are provided. The severity is assessed as medium.
A security update for cockpit-subscriptions addresses a prototype pollution vulnerability in the js-yaml library. The issue, tracked as CVE-2025-64718, was fixed in version 12.1 of cockpit-subscriptions. The vulnerability is classified with medium severity. No CVSS score is provided.
This update for php8 fixes the following issues:
Version update to 8.4.16:
Security fixes:
- CVE-2025-14177: getimagesize() function may leak uninitialized heap memory into the APPn segments when reading images in multi-chunk mode (bsc#1255710).
- CVE-2025-14178: heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE (bsc#1255711).
- CVE-2025-14180: null pointer dereference in pdo_parse_params() function when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled (bsc#1255712).
Other fixes:
- php8 contains Directories owned by wwwrun but does not require User. (bsc#1255043)
SUSE released a security update for the Linux Kernel used in SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2. The update addresses multiple security bugs across various kernel subsystems including networking, scheduling, memory management, filesystems, and device drivers. These fixes resolve issues such as race conditions, use-after-free, null pointer dereferences, deadlocks, and other kernel-level bugs. The update is intended to improve system stability and security by patching these vulnerabilities.
This update for the SUSE Linux Enterprise kernel 6.12.0-160000.6.1 fixes various security issues
The following security issues were fixed:
- CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251982).
- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).
- CVE-2025-40212: nfsd: fix refcount leak in nfsd_set_fh_dentry() (bsc#1254196).
This update for avahi fixes the following issues:
- CVE-2025-68276: Fixed refuse to create wide-area record browsers when
wide-area is off (bsc#1256498)
- CVE-2025-68471: Fixed DoS bug by changing assert to return (bsc#1256500)
- CVE-2025-68468: Fixed DoS bug by removing incorrect assertion (bsc#1256499)
A high-severity vulnerability in the Linux kernel's NFS server daemon (nfsd) was fixed to address a reference count leak in the nfsd_set_fh_dentry() function. This flaw could lead to use-after-free conditions and potential denial of service if a client synthesizes an incorrect filehandle, specifically when a NFSv3 or v2 client uses a filehandle from the NFSv4 pseudo root filesystem. The issue arises because the export is stored despite an error, causing an extra reference drop later. The fix delays assignments until after error checks to prevent this.
A heap buffer overflow vulnerability exists in the PHP array_merge() function in versions prior to 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1. The flaw occurs due to an integer overflow in element count precomputation when merging packed arrays with a total element count exceeding 32-bit limits or HT_MAX_SIZE. This can lead to memory corruption or crashes, affecting server integrity and availability. Red Hat has released security updates addressing this issue in their PHP packages for Red Hat Enterprise Linux 9.6 Extended Update Support.
The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
This release of the Red Hat build of OpenJDK 17 (17.0.18) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 17 (17.0.17) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* JDK: Improve JMX connections (CVE-2026-21925)
* JDK: Improve HttpServer Request handling (CVE-2026-21933)
* JDK: Enhance Certificate Checking (CVE-2026-21945)
* libpng: LIBPNG buffer overflow (CVE-2025-64720)
* libpng: LIBPNG heap buffer overflow (CVE-2025-65018)
Bug Fix(es):
* When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (OPENJDK-4398)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for BIND addresses CVE-2025-13878, which fixes incorrect length checks for BRID and HHIT DNS record types. The update also includes various feature improvements and bug fixes related to DNSSEC, catalog zones, and DNS-over-TLS. No known exploits are reported in the wild. The update is part of BIND release 9.20.18.
This security update for BusyBox addresses multiple issues, including two security vulnerabilities: CVE-2025-60876, an HTTP request header injection vulnerability in wget, and CVE-2025-46394, a vulnerability involving hidden files in tar via escape sequences. The update also includes other non-security fixes. The vulnerabilities have been classified as high severity. No CVSS score is provided for these issues.
### Impact
urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.
urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.
However, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client (high CPU usage and large memory allocations for decompressed data; CWE-409).
### Affected usages
Applications and libraries using urllib3 version 2.6.2 and earlier to stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.
### Remediation
Upgrade to at least urllib3 v2.6.3 in which the library does not decode content of redirect responses when `preload_content=False`.
If upgrading is not immediately possible, disable [redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests) by setting `redirect=False` for requests to untrusted source.
This security update for gdk-pixbuf addresses two high severity vulnerabilities: a heap buffer overflow in the JPEG image loading function and an uninitialized memory issue that could lead to leaking arbitrary memory contents. Both vulnerabilities are fixed in the update. No specific affected versions beyond the provided package versions are detailed.
A security update for Python 3.13 addresses multiple moderate severity vulnerabilities including denial of service issues in the xml.dom.minidom and http.client modules, and validation issues in the zipfile module. The update also includes performance improvements and other bug fixes. Patches have been released by vendors such as Red Hat for affected versions. The vulnerabilities could lead to denial of service conditions but no known exploits are reported in the wild.