Search: 18.8.3.2

GitPython versions before 3.2.0 contain a remote code execution vulnerability. This flaw arises because Git.ls_remote forwards URLs without validating unsafe protocols, allowing attackers to supply malicious ext:: remote-helper URLs. Additionally, the merge_base and IndexFile.move functions accept unguarded option injection. The vulnerability has a high severity with a CVSS score of 7.5.

GitPython versions before 3.2.0 have a regular expression denial of service (ReDoS) vulnerability in the _re_actor_epoch pattern used during parsing of author, committer, and tagger lines. Malicious repositories with specially crafted commit or tag objects containing long space-filled lines without valid epoch or timezone can cause excessive CPU usage due to quadratic backtracking.

GitPython versions before 3.2.0 contain an information disclosure vulnerability. This flaw allows malicious Git repositories to exploit environment variable expansion in the separate_git_dir parameter during cloning operations. Attackers can craft .gitmodules submodule names with variable syntax, causing secrets to be exposed in .git/modules directory names and DEBUG logs.

FreeRDP versions before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, contain a heap-based out-of-bounds write vulnerability in the winpr_convert_from_jpeg function. This occurs because grayscale JPEG buffers are sized incorrectly, leading to memory corruption when a malicious RDP server sends a grayscale JPEG via clipboard redirection. The client may crash when pasting the clipboard item as CF_DIB bitmap data. The vulnerability has a CVSS score of 7.1 (high severity) and is fixed in version 3.32.0.

FreeRDP shadow server versions from 3.0.0 up to but not including 3.32.0 allow unauthenticated attackers to inject keyboard input during the Confirm Active state before authentication. This occurs because input PDUs are dispatched prematurely, enabling attackers negotiating TLS-only RDP to send input PDUs without Confirm Active and inject synthetic keystrokes into the host user's X11 session via XTEST.

FreeRDP versions before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, contain a heap-based buffer overflow vulnerability in the MP3 decoding function. This flaw allows a malicious RDP server to send crafted MP3 audio data that causes the client to crash by overflowing heap memory.

FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain an infinite loop vulnerability in the http_response_recv() function. This flaw allows a malicious gateway to exhaust the client CPU by sending crafted Content-Type headers with a nonzero Content-Length and an unrecognized Content-Type containing a semicolon. The vulnerability can cause a client thread to be pinned at full CPU indefinitely, resulting in a denial of service.

FreeRDP versions from 2.0.0 up to but not including 3.32.0 contain a null pointer dereference vulnerability. This flaw allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs, specifically IRP_MJ_READ or IRP_MJ_WRITE requests before create or after close. The issue causes the client to dereference a null handle in CommReadFile or CommWriteFile, leading to termination of the client process.

FreeRDP versions from 2.0.0 up to but not including 3.32.0 contain a memory exhaustion vulnerability in the wts_read_drdynvc_data_first function. Authenticated clients can exploit this flaw by sending a crafted DATA_FIRST message that declares a large 32-bit length, causing the server to allocate excessive zeroed memory and potentially exhaust server resources. This vulnerability has been assigned CVE-2026-110832 and is rated medium severity with a CVSS score of 6.5. Fixed versions are available starting from 3.32.0.

FreeRDP versions from 3.13.0 up to but not including 3.32.0 contain a resource retention flaw in the drive_process_irp_create function. This flaw occurs because an opened local file is registered in the drive dictionary before the allocation size is applied, and if the allocation size operation fails, the file object and OS handle are not removed, causing a resource leak. A malicious RDP server can exploit this by sending a crafted IRP_MJ_CREATE request with an allocation size set to UINT64_MAX, forcing the failure and leaking resources until the drive is torn down. The issue has a medium severity with a CVSS score of 4.3 and has been fixed in FreeRDP version 3.32.0.

FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain a null pointer dereference vulnerability in the rdpsnd channel. This occurs when a fragment sets the CHANNEL_FLAG_LAST flag without the CHANNEL_FLAG_FIRST flag. A malicious RDP server can exploit this by sending a malformed rdpsnd PDU on a new channel, causing the client to crash and resulting in denial of service.

FreeRDP versions before 3.32.0 contain an HTTP header injection vulnerability in its proxy component. This occurs because a lone line feed (LF) character in the target portion of a routing token (Cookie: msts=) is not properly rejected. An unauthenticated remote RDP client connecting to a proxy with FixedTarget=false and an upstream HTTP proxy can manipulate HTTP request and header framing at the upstream proxy.

FreeRDP versions from 3.0.0-beta1 up to but not including 3.32.0 contain a vulnerability in the proxy component where cumulative or absolute size limits are not enforced when reassembling RDPDR channel fragments. This allows an attacker to send a FIRST fragment followed by continuation fragments without a LAST fragment, causing the proxy to allocate growing per-session heap streams proportional to traffic, which can exhaust proxy memory and cause denial of service.

FreeRDP versions before 3.32.0 contain a vulnerability where prior serial handles are not closed properly in the serial_process_irp_create function. This flaw allows a malicious RDP server to exhaust file descriptors by sending repeated serial IRP_MJ_CREATE requests, potentially causing the client to terminate due to a file descriptor assertion failure.

A security vulnerability exists in Praat up to version 7.0.02 in the function whisper_model_load within external/whispercpp/whisper.cpp. The flaw involves manipulation of the argument n_dims leading to an out-of-bounds write. This vulnerability can be exploited remotely and has publicly disclosed exploit code. A quick fix was applied in Praat version 7.0.03, with a more comprehensive fix planned.

A high-severity vulnerability exists in OpenSIPS versions up to 3.6.8 and 4.0.1 affecting the rtpproxy component's rtpproxy_offer and rtpproxy_answer functions. This flaw allows a remote attacker to cause an out-of-bounds read. Upgrading to OpenSIPS versions 3.6.9 or 4.0.2 resolves the issue.

CVE-2026-61844 is a vulnerability in FileRise, a self-hosted web-based file manager, affecting versions prior to 3.18.0. The issue arises from how FileRise flattens logical folder paths into metadata filenames, causing distinct folders to share one metadata file. This allows a low-privileged user with control over one colliding folder and read_own access to another folder to manipulate metadata, potentially gaining unauthorized read and edit access to files. The vulnerability is fixed in version 3.18.0.

FileRise versions prior to 3.18.0 contain a missing authorization vulnerability that allows unauthenticated users with a valid share token and any configured share password to overwrite existing files by uploading a file with the same name. This flaw also affects authenticated uploads where users lack edit permissions, enabling silent replacement of file content without changing the original uploader metadata. The issue is resolved in version 3.18.0.

This update includes the following RPMs: mariadb10.11: * mariadb10.11-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-backup-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-client-utils-10.11.18-4.1.hum1 (noarch) * mariadb10.11-common-10.11.18-4.1.hum1 (noarch) * mariadb10.11-connect-engine-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-cracklib-password-check-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-devel-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-embedded-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-embedded-devel-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-errmsg-10.11.18-4.1.hum1 (noarch) * mariadb10.11-gssapi-server-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-oqgraph-engine-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-pam-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-rocksdb-engine-10.11.18-4.1.hum1 (x86_64) * mariadb10.11-s3-engine-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-server-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-server-galera-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-server-utils-10.11.18-4.1.hum1 (noarch) * mariadb10.11-sphinx-engine-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-test-10.11.18-4.1.hum1 (aarch64, s390x, x86_64) * mariadb10.11-10.11.18-4.1.hum1.src (src) Security Fix(es): mariadb10.11: * CVE-2026-107823 * CVE-2026-107814 * CVE-2026-107815 * CVE-2026-107816 * CVE-2026-107817 * CVE-2026-107818 * CVE-2026-107821 * CVE-2026-107822

PgBouncer versions 1.17.0 through 1.26.0 contain an improper authentication vulnerability that allows a remote attacker who knows a user's password to log in as any other SCRAM-authenticated user, including admin and superuser accounts. This occurs because a second StartupMessage during SCRAM authentication against a non-existent database is not rejected and switches the logged-in user while still verifying the SCRAM exchange against the first user's credentials.