This security update for Apache HTTP Server (apache2) addresses multiple vulnerabilities including unintended retry intervals in mod_md (ACME), query string injection in Server Side Includes, CGI environment variable override, and a mod_userdir+suexec bypass via AllowOverride FileInfo. The update fixes these issues in affected versions of apache2, improving the security posture of the server. The vulnerabilities have been rated with medium severity and no known exploits are reported in the wild at this time.
This update for gpg2 fixes the following issues:
- CVE-2025-68973: out-of-bounds write when processing specially crafted input in the armor parser can lead to memory corruption (bsc#1255715).
Other security fixes:
- gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures (bsc#1256246).
- gpg: Error out on unverified output for non-detached signatures (bsc#1256244).
- gpg: Deprecate the option --not-dash-escaped (bsc#1256390).
This security update for Squid addresses two vulnerabilities: CVE-2025-62168, which involves failure to redact HTTP authentication credentials in error handling leading to credential disclosure, and CVE-2025-59362, a stack-based buffer overflow in the SNMP message processing component. Both issues could lead to sensitive information exposure or potential memory corruption. The vulnerabilities are rated as high severity. No specific affected versions or patch details are provided in the input data.
This security update for libmicrohttpd addresses two vulnerabilities: a heap-based buffer overflow (CVE-2025-62689) and a NULL pointer dereference (CVE-2025-59777). Both vulnerabilities can be triggered by specially crafted packets and may lead to application crashes or memory corruption. The update fixes these issues to improve the security of libmicrohttpd. No specific patch details or affected version ranges are provided.
Multiple heap buffer over-read and out-of-bounds read vulnerabilities exist in libpng16, affecting processing of malformed or specially crafted PNG images. These vulnerabilities can cause memory corruption or crashes when handling certain palette indices, 8-bit input with specific conversion enabled, palette images with alpha optimization, 16-bit interlaced PNGs with 8-bit output, and palette PNGs with partial transparency and gamma correction. The issues are rated high severity. No explicit patch or remediation details are provided.
The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.
Security Fix(es):
* wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security update for the matio library addresses multiple issues including a heap-based buffer overflow and an array index out of bounds error when printing UTF-8 character data. The update to version 1.5.29 fixes these vulnerabilities along with other bugs related to access violations in Mat_VarPrint. The update also includes fixes from version 1.5.28 addressing bugs in reading and writing MAT files and other improvements.
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
CVE-2025-66001 is a high-severity vulnerability in SUSE NeuVector version 5.3.0 where TLS verification for OpenID Connect login authentication is not enforced by default. This improper certificate validation (CWE-295) allows attackers to perform man-in-the-middle (MITM) attacks, potentially compromising confidentiality, integrity, and availability of the system. Exploitation requires no privileges but does require user interaction during login. The vulnerability has a CVSS score of 8.8, indicating a high impact with network attack vector and low attack complexity. No known exploits are currently reported in the wild. European organizations using NeuVector 5.3.
Multiple security issues were addressed in the gdk-pixbuf-loader-libheif package version 1.21.1-1.1 on openSUSE Tumbleweed GA media. These vulnerabilities affect specific versions of gdk-pixbuf-loader-libheif and related libheif packages on the aarch64 architecture. The issues have been fixed in the updated package release.
Two security vulnerabilities have been identified in PostgreSQL affecting Red Hat Enterprise Linux 9.4 Extended Update Support. The first vulnerability (CVE-2025-12817) involves the CREATE STATISTICS command not properly checking for schema CREATE privileges. The second vulnerability (CVE-2025-12818) involves libpq undersizing memory allocations due to integer wraparound. Both issues have been addressed in a security update released by Red Hat. The update is rated as having a moderate security impact. Users of affected Red Hat Enterprise Linux 9.4 versions should apply the provided security update to remediate these issues.
A moderate severity security vulnerability (CVE-2025-8291) affects Python 3.12 in Red Hat Enterprise Linux 9.6 Extended Update Support and related products. The issue involves the Python zipfile module where the End of Central Directory (EOCD) Locator record offset is not properly checked. This vulnerability has been addressed by Red Hat in updated python3.12 packages. Users of affected Red Hat Enterprise Linux 9.6 EUS and CodeReady Linux Builder 9.6 should apply the provided security update to remediate the issue.
Multiple security vulnerabilities in valkey related to Lua scripting have been fixed in version 8.0.6. These include remote code execution via Lua scripts, integer overflow leading to potential RCE, execution of Lua scripts in another user's context, and out-of-bound read issues. The update also includes various bug fixes unrelated to security. The vulnerabilities are rated critical and patches are available.
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities affecting Mozilla Thunderbird 140.5.0 ESR have been addressed in this update. These include race conditions, use-after-free bugs, same-origin policy bypasses, mitigation bypasses, and spoofing issues across various components such as Graphics, JavaScript WebAssembly, DOM, WebRTC, and Audio/Video. The update also fixes functional issues unrelated to security. The vulnerabilities are rated as high severity and patches are available in the updated Thunderbird 140.5.0 ESR release.