Threat database

WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3. Security Fix(es): * webkitgtk: webkitgtk: Use-after-free due to improper memory management (CVE-2025-43529) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43501) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43531) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43535) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43536) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for salt fixes the following issues: Changes in salt: - Add minimum_auth_version to enforce security (CVE-2025-62349) - Backport security fixes for vendored tornado * BDSA-2024-3438 * BDSA-2024-3439 * BDSA-2024-9026 - Junos module yaml loader fix (CVE-2025-62348) - Require Python dependencies only for used Python version - Fix TLS and x509 modules for OSes with older cryptography module - Fix Salt for Python > 3.11 (bsc#1252285, bsc#1252244) - Fix payload signature verification on Tumbleweed (bsc#1251776) - Fix broken symlink on migration to Leap 16.0 (bsc#1250755) - Use versioned python interpreter for salt-ssh - Fix known_hosts error on gitfs (bsc#1250520, bsc#1227207) - Revert require M2Crypto >= 0.44.0 for SUSE Family distros - Improve SL Micro 6.2 detection with grains - Fix the tests failing on AlmaLinux 10 and other clones

### Impact This issue describes a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption` ). In systems that take unchecked user content, this could cause long hangs when processing the data if a malicious payload was crafted. ### Patches This issue is patched in Release [10.16.1](https://pypi.org/project/pymdown-extensions/10.16.1/). ### Workarounds Some possible workarounds If users are concerned about this vulnerability and process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems, the use of `pymdownx.blocks.caption` could be avoided until the library is updated to 10.16.1+. ### References The original issue https://github.com/facelessuser/pymdown-extensions/issues/2716. ### Description The original issue came through PyMdown Extensions' normal issue tracker instead of the typical security flow: https://github.com/facelessuser/pymdown-extensions/issues/2716. Because this came through the normal issue flow, it was handled as a normal issue. In the future, PyMdown Extensions will ensure such issues, even if prematurely made public through the normal issue flow, are redirected through the typical security process. The regular expression pattern in question is as follows: ```py RE_FIG_NUM = re.compile(r'^(\^)?([1-9][0-9]*(?:.[1-9][0-9]*)*)(?= |$)') ``` The POC was provided by @ShangzhiXu ```py import re import time regex_pattern = re.compile(r'^(\^)?([1-9][0-9]*(?:.[1-9][0-9]*)*)(?= |$)') for i in range(50, 500, 50): long_string = '1' * i + 'a' start_time = time.time() match = re.match(regex_pattern, long_string) end_time = time.time() print(f"long_string execution time: {end_time - start_time:.6f} s") ``` The issue with the above pattern is that `.` was used, which accepts any character when we meant to use `\.`. The fix was to update the pattern to: ```py RE_FIG_NUM = re.compile(r'^(\^)?([1-9][0-9]*(?:\.[1-9][0-9]*)*)(?= |$)') ``` Relevant PR with fix: https://github.com/facelessuser/pymdown-extensions/pull/2717 ### Version(s) & System Info - Operating System: Any - Python Version: Any

A security vulnerability in the Linux kernel's clone_private_mnt() function was identified and fixed. The flaw was due to missing verification that the caller has the CAP_SYS_ADMIN capability in the appropriate user namespace, which could allow unauthorized mount namespace operations. This issue affects Red Hat Enterprise Linux 9 and related variants. A patch is available and requires a system reboot to take effect.

Package binutils version 2.46.0-r0 fixes 2 vulnerabilities: CVE-2025-11083, CVE-2025-11082

This update for postgresql13 fixes the following issues: Security fixes: - CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts (bsc#1253332) - CVE-2025-12818: Fixed several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which would then lead to writing past the end of the buffer (bsc#1253333) Other fixes: - Update to 13.23 * https://www.postgresql.org/about/news/p-3171/ * https://www.postgresql.org/docs/release/13.23

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A security update has been released for the Linux kernel packages used in Red Hat Enterprise Linux 9 and related distributions. The update addresses two vulnerabilities: CVE-2025-39925, which implements a NETDEV_UNREGISTER notification handler in the CAN J1939 subsystem, and CVE-2025-39979, which fixes a use-after-free (UAF) vulnerability in the mlx5 network driver flow counter release. These vulnerabilities have been rated with moderate severity by Red Hat. The update requires a system reboot to take effect.

A moderate severity vulnerability in the Linux kernel's CIFS module (CVE-2025-38737) has been fixed by initializing a buffer variable to NULL before use, preventing a kernel oops caused by an uninitialized variable. This update is part of a broader kernel security update for Red Hat Enterprise Linux 10 and related products. The fix requires a system reboot to take effect.

Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages used by Red Hat Enterprise Linux 10 and related products. These fixes address issues such as queue cancellation state, failure handling in NFS daemon, memory unpoisoning bugs, heap overflow in e1000e driver, linked list corruption in mt76 WiFi driver, and index validation in i40e driver configuration messages. The update is rated as having moderate security impact and requires a system reboot to take effect.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10922) * gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This security update provides a functional equivalent of RHSA-2025:22405. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2025:22405.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after (bsc#1238472). - CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630). - CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161). - CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302). - CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317). - CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512). - CVE-2025-39779: btrfs: subpage: keep TOWRITE tag until folio is cleaned (bsc#1249495). - CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202). - CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455). - CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400). - CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379). - CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721). - CVE-2025-39903: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749). - CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704). - CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232). - CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233). - CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177). - CVE-2025-39950: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176). - CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804). - CVE-2025-39956: igc: don't fail igc_probe() on LED setup error (bsc#1251809). - CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819). - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047). - CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044). - CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051). - CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052). - CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039). - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035). - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069). - CVE-2025-39979: net/mlx5: fs, add API for sharing HWS action by refcount (bsc#1252067). - CVE-2025-39984: net: tun: Update napi->skb after XDP process (bsc#1252081). - CVE-2025-39992: mm: swap: check for stable address space before operating on the VMA (bsc#1252076). - CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062). - CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349). - CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330). - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688). - CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780). - CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858). - CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826). - CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848). - CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789). - CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774). - CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918). The following non security issues were fixed: - add bug reference to existing hv_netvsc change (bsc#1252265) - amd-pstate-ut: Reset amd-pstate driver mode after running selftests (bsc#1249226). - cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition (bsc#1241166). - cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166). - cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166). - doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT The character was previously 'N', but upstream used it for TAINT_TEST, which prompted the change of TAINT_NO_SUPPORT to 'n'. - dpll: zl3073x: Add firmware loading functionality (bsc#1252253). - dpll: zl3073x: Add functions to access hardware registers (bsc#1252253). - dpll: zl3073x: Add low-level flash functions (bsc#1252253). - dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253). - dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253). - dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253

SUSE has released a security update for the Linux Kernel used in SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2. This update addresses numerous security bugs across various kernel subsystems, including networking, scheduling, memory management, KVM virtualization, filesystems, and device drivers. The update fixes issues such as race conditions, use-after-free bugs, null pointer dereferences, deadlocks, and other stability and security problems. No specific affected versions are detailed in the provided data. The update is classified as high severity due to the broad range of kernel components impacted and the nature of the fixes.

A medium severity vulnerability (CVE-2025-39843) in the Linux kernel's memory management subsystem (slub allocator) has been resolved. The issue involves a potential deadlock caused by lock recursion when set_track_prepare() wakes up the kswapd process while holding a per-CPU lock, under certain debug configurations. This can lead to a spinlock recursion oops on affected systems. The vulnerability affects various Red Hat Enterprise Linux 9 versions and SUSE kernel packages. A security update is available and should be applied with a system reboot.

An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.

Multiple security vulnerabilities affecting Mozilla Thunderbird integrated with Firefox components have been addressed in a Red Hat Enterprise Linux 9.6 update. These include use-after-free, race conditions, mitigation bypasses, same-origin policy bypasses, and spoofing vulnerabilities. The update is rated as important by Red Hat Product Security and fixes several CVEs related to Firefox components used by Thunderbird.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.29. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/156359 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561) * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133) * runc: container escape with malicious config due to /dev/console mount and related races (CVE-2025-52565) * runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

This update for MozillaThunderbird fixes the following issues: Changes in MozillaThunderbird: - Mozilla Thunderbird 140.10.0 ESR * Newly translated strings were not available in Thunderbird MFSA 2026-34 (bsc#1262230) * CVE-2026-6746 Use-after-free in the DOM: Core & HTML component * CVE-2026-6747 Use-after-free in the WebRTC component * CVE-2026-6748 Uninitialized memory in the Audio/Video: Web Codecs component * CVE-2026-6749 Information disclosure due to uninitialized memory in the Graphics: Canvas2D component * CVE-2026-6750 Privilege escalation in the Graphics: WebRender component * CVE-2026-6751 Uninitialized memory in the Audio/Video: Web Codecs component * CVE-2026-6752 Incorrect boundary conditions in the WebRTC component * CVE-2026-6753 Incorrect boundary conditions in the WebRTC component * CVE-2026-6754 Use-after-free in the JavaScript Engine component * CVE-2026-6757 Invalid pointer in the JavaScript: WebAssembly component * CVE-2026-6759 Use-after-free in the Widget: Cocoa component * CVE-2026-6761 Privilege escalation in the Networking component * CVE-2026-6762 Spoofing issue in the DOM: Core & HTML component * CVE-2026-6763 Mitigation bypass in the File Handling component * CVE-2026-6764 Incorrect boundary conditions in the DOM: Device Interfaces component * CVE-2026-6765 Information disclosure in the Form Autofill component * CVE-2026-6766 Incorrect boundary conditions in the Libraries component in NSS * CVE-2026-6767 Other issue in the Libraries component in NSS * CVE-2026-6769 Privilege escalation in the Debugger component * CVE-2026-6770 Other issue in the Storage: IndexedDB component * CVE-2026-6771 Mitigation bypass in the DOM: Security component * CVE-2026-6772 Incorrect boundary conditions in the Libraries component in NSS * CVE-2026-6776 Incorrect boundary conditions in the WebRTC: Networking component * CVE-2026-6785 Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 * CVE-2026-6786 Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 - Mozilla Thunderbird 140.9.1 ESR MFSA 2026-29 * CVE-2026-5732 Incorrect boundary conditions, integer overflow in the Graphics: Text component * CVE-2026-5731 Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 * CVE-2026-5734 Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 - Mozilla Thunderbird 140.9.0 ESR MFSA 2026-24 (bsc#1260083) * CVE-2026-3889 Spoofing issue in Thunderbird * CVE-2026-4371 Out of bounds read in IMAP parsing * CVE-2026-4684 Race condition, use-after-free in the Graphics: WebRender component * CVE-2026-4685 Incorrect boundary conditions in the Graphics: Canvas2D component * CVE-2026-4686 Incorrect boundary conditions in the Graphics: Canvas2D component * CVE-2026-4687 Sandbox escape due to incorrect boundary conditions in the Telemetry component * CVE-2026-4688 Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-4689 Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component * CVE-2026-4690 Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component * CVE-2026-4691 Use-after-free in the CSS Parsing and Computation component * CVE-2026-4692 Sandbox escape in the Responsive Design Mode component * CVE-2026-4693 Incorrect boundary conditions in the Audio/Video: Playback component * CVE-2026-4694 Incorrect boundary conditions, integer overflow in the Graphics component * CVE-2026-4695 Incorrect boundary conditions in the Audio/Video: Web Codecs component * CVE-2026-4696 Use-after-free in the Layout: Text and Fonts component * CVE-2026-4697 Incorrect boundary conditions in the Audio/Video: Web Codecs component * CVE-2026-4698 JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-4699 Incorrect boundary conditions in the Layout: Text and Fonts component * CVE-2026-4700 Mitigation bypass in the Networking: HTTP component * CVE-2026-4701 Use-after-free in the JavaScript Engine component * CVE-2026-4702 JIT miscompilation in the JavaScript Engine component * CVE-2026-4704 Denial-of-service in the WebRTC: Signaling component * CVE-2026-4705 Undefined behavior in the WebRTC: Signaling component * CVE-2026-4706 Incorrect boundary conditions in the Graphics: Canvas2D component * CVE-2026-4707 Incorrect boundary conditions in the Graphics: Canvas2D component * CVE-2026-4708 Incorrect boundary conditions in the Graphics component * CVE-2026-4709 Incorrect boundary conditions in the Audio/Video: GMP component * CVE-2026-4710 Incorrect boundary conditions in the Audio/Video component * CVE-2026-4711 Use-after-free in the Widget: Cocoa compo