Threats affecting pkg:generic/htslib

Zipline versions 4.0.0 through 4.7.x contain an upload filter bypass vulnerability. This flaw allows users with upload permissions to store file types that should be blocked due to a mismatch in extension format checking. The vulnerability arises because the upload handlers compare dotted, case-sensitive file extensions against undotted disabled extension entries, enabling bypass of administrator restrictions. The issue is fixed in version 4.8.0.

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.

Red Hat issued a security advisory for webkit2gtk3, addressing multiple vulnerabilities in the Chromium browser components Skia and ANGLE. The vulnerabilities include out of bounds reads, buffer overflows, use after free, uninitialized resource usage, and race conditions. These issues affect the WebKitGTK port of the WebKit rendering engine on the GTK platform. The update is rated as important by Red Hat Product Security and is available for Red Hat Enterprise Linux 9 on multiple architectures.

CVE-2026-126757 is an open redirect vulnerability in Moonshot AI Kimi Code versions 2.5.0, 2.5.1, and 2.5.2. It affects the isOriginAllowed function in the Web UI component, allowing remote attackers to manipulate the kimi_origin argument to redirect users to arbitrary URLs. The vulnerability has a medium severity score of 5.3 and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation is currently available.

Two denial of service vulnerabilities have been identified in the c-ares C library, which handles asynchronous DNS requests and name resolution. The first vulnerability (CVE-2026-69186) involves unvalidated DNS header record counts leading to denial of service. The second (CVE-2026-69184) allows CPU exhaustion through unbounded DNS name compression pointer chains. Red Hat has issued security updates for Red Hat Enterprise Linux 10.2 Extended Update Support and related variants to address these issues.

Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)