This security update for the docker-stable package from SUSE addresses configuration and packaging issues, including enabling SELinux by default in the daemon configuration and removing unnecessary git-core recommendations on SLE systems. It also adds historical changelog data with CVE references for security tracking. There is no indication of active exploitation or a specific vulnerability disclosed.
A security update for GIMP addresses a vulnerability identified as CVE-2025-15059. This update is functionally equivalent to the Red Hat advisory RHSA-2026:2930. No specific affected versions or technical details are provided in the input data.
A security update addresses multiple vulnerabilities in Node.js packages distributed by Red Hat and SUSE, including CVE-2025-55130. The update affects Red Hat Hardened Images and related Node.js RPM packages. The vulnerabilities are rated as high severity. A patch is available and has been released by Red Hat as part of their hardened images update.
CVE-2025-37882 is a race condition vulnerability in the Linux kernel's xHCI USB driver related to isochronous event handling. It can lead to data loss or use-after-free conditions. This issue is addressed by a security update from Red Hat for Enterprise Linux 9.6 Extended Update Support, which requires a system reboot. The update also fixes several other kernel vulnerabilities.
A security update for openCryptoki addresses multiple high-severity vulnerabilities including CVE-2026-22791, CVE-2026-23893, and CVE-2026-40253 by upgrading to version 3.27. This update adds support for PKCS#11 v3.2 features and fixes several bugs, improving cryptographic mechanism support.
This security update for Trivy addresses multiple vulnerabilities across various dependencies including hashicorp/go-getter, golang.org/x/crypto/ssh, golang.org/x/net/html, github.com/golang-jwt/jwt, and others. The fixes cover issues such as argument injection, authorization bypass, denial of service, memory consumption, information leaks, and code execution. The update also includes other non-security related fixes and dependency upgrades. No specific affected versions of Trivy are stated in the provided data.
A security update for htmldoc addresses multiple issues including a critical buffer overflow vulnerability (CVE-2024-46478) in the parse_pre function when handling tabs. The update also fixes various regressions and bugs across versions 1.9.19 through 1.9.23, improving stability and functionality. The buffer overflow flaw could potentially allow memory corruption. No CVSS score is provided, but the severity is marked critical.
This is a security update for Rust version 1.93.0 provided by SUSE Product Security Team. The update addresses unspecified security issues in Rust 1.93.0. No detailed vulnerability or exploit information is provided in the source data.
Two security vulnerabilities have been identified in the libsoup HTTP client and server library used in GNOME, affecting Red Hat Enterprise Linux 7 Extended Lifecycle Support. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error that leads to a stack-based buffer overflow in NTLM authentication. The second vulnerability (CVE-2026-1761) is a stack-based buffer overflow in multipart HTTP response parsing. These issues could potentially allow attackers to cause memory corruption. Red Hat has released security updates addressing these vulnerabilities.
A security update for MicroPython addresses a segmentation fault vulnerability (CVE-2026-1998) in the function mp_map_lookup triggered via mp_import_all. The update also includes various component updates and fixes unrelated to the vulnerability. No CVSS score is provided, but the issue is assessed as low severity.
This update for munge fixes the following issues:
- CVE-2026-25506: buffer overflow in message unpacking (bsc#1257651).
- Make `logrotate` work on log as user `munge` to prevent local privilege escalation (bsc#1246088).
A heap buffer over-read vulnerability (CVE-2024-8929) exists in the mysqlnd extension of PHP, allowing a hostile MySQL server to cause the PHP client to leak partial heap contents. This may disclose data from other SQL requests or other users on the same server. The vulnerability affects multiple PHP versions prior to fixed releases. Red Hat has released official patches addressing this issue in their php:7.4 module for Red Hat Enterprise Linux 8. The security impact is rated as moderate.
A critical authentication bypass vulnerability (CVE-2026-1709) exists in Keylime, a TPM-based remote boot attestation and runtime integrity measurement solution. The issue arises from missing client-side TLS authentication, allowing unauthorized administrative operations. This vulnerability affects Keylime packages distributed with Red Hat Enterprise Linux 10 across multiple architectures. Red Hat has issued a security update to address this flaw.
Multiple security vulnerabilities affecting the Linux kernel in Red Hat Enterprise Linux 9.6 Extended Update Support and related products have been addressed in a security update. The issues include buffer overflows, use-after-free, out-of-bounds reads and writes, and information disclosure in various kernel subsystems such as NFS, Bluetooth, RDMA, SMB client, and font glyph handling. These vulnerabilities have a moderate security impact and require a system reboot after patching to take effect.
This update for python313 fixes the following issues:
- Update to 3.13.11:
- Security
- CVE-2025-12084: cpython: Fixed quadratic algorithm in
xml.dom.minidom leading to denial of service (bsc#1254997)
- CVE-2025-13836: Fixed default Content-Lenght read amount
from HTTP response (bsc#1254400)
- CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)
- CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory
(EOCD) not checked by the 'zipfile' module (bsc#1251305)
- gh-137836: Add support of the “plaintext” element, RAWTEXT
elements “xmp”, “iframe”, “noembed” and “noframes”, and
optionally RAWTEXT element “noscript” in
html.parser.HTMLParser.
- gh-136063: email.message: ensure linear complexity for
legacy HTTP parameters parsing. Patch by Bénédikt Tran.
- CVE-2025-6075: Fixed performance issues caused by user-controller
os.path.expandvars() (bsc#1252974)
- Library
- gh-140797: Revert changes to the undocumented re.Scanner
class. Capturing groups are still allowed for backward
compatibility, although using them can lead to incorrect
result. They will be forbidden in future Python versions.
- gh-142206: The resource tracker in the multiprocessing
module now uses the original communication protocol, as in
Python 3.14.0 and below, by default. This avoids issues
with upgrading Python while it is running. (Note that such
‘in-place’ upgrades are not tested.) The tracker remains
compatible with subprocesses that use new protocol (that
is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).
- Core and Builtins
- gh-142218: Fix crash when inserting into a split table
dictionary with a non str key that matches an existing key.
- Update to 3.13.10:
- Tools/Demos
- gh-141442: The iOS testbed now correctly handles test
arguments that contain spaces.
- Tests
- gh-140482: Preserve and restore the state of stty echo as
part of the test environment.
- gh-140082: Update python -m test to set FORCE_COLOR=1 when
being run with color enabled so that unittest which is run
by it with redirected output will output in color.
- gh-136442: Use exitcode 1 instead of 5 if
unittest.TestCase.setUpClass() raises an exception
- Library
- gh-74389: When the stdin being used by a subprocess.Popen
instance is closed, this is now ignored in
subprocess.Popen.communicate() instead of leaving the class
in an inconsistent state.
- gh-87512: Fix subprocess.Popen.communicate() timeout
handling on Windows when writing large input. Previously,
the timeout was ignored during stdin writing, causing the
method to block indefinitely if the child process did not
consume input quickly. The stdin write is now performed in
a background thread, allowing the timeout to be properly
enforced.
- gh-141473: When subprocess.Popen.communicate() was called
with input and a timeout and is called for a second time
after a TimeoutExpired exception before the process has
died, it should no longer hang.
- gh-59000: Fix pdb breakpoint resolution for class methods
when the module defining the class is not imported.
- gh-141570: Support file-like object raising OSError from
fileno() in color detection (_colorize.can_colorize()).
This can occur when sys.stdout is redirected.
- gh-141659: Fix bad file descriptor errors from
_posixsubprocess on AIX.
- gh-141497: ipaddress: ensure that the methods
IPv4Network.hosts() and IPv6Network.hosts() always return
an iterator.
- gh-140938: The statistics.stdev() and statistics.pstdev()
functions now raise a ValueError when the input contains an
infinity or a NaN.
- gh-124111: Updated Tcl threading configuration in _tkinter
to assume that threads are always available in Tcl 9 and
later.
- gh-137109: The os.fork and related forking APIs will no
longer warn in the common case where Linux or macOS
platform APIs return the number of threads in a process and
find the answer to be 1 even when a os.register_at_fork()
after_in_parent= callback (re)starts a thread.
- gh-141314: Fix assertion failure in io.TextIOWrapper.tell()
when reading files with standalone carriage return (\r)
line endings.
- gh-141311: Fix assertion failure in io.BytesIO.readinto()
and undefined behavior arising when read position is above
capcity in io.BytesIO.
- gh-141141: Fix a thread safety issue with
base64.b85decode(). Contributed by Benel Tayar.
- gh-140911: collections: Ensure that the methods
UserString.rindex() and UserString.index() accept
collections.UserString instances as the sub argument.
- gh-140797: The undocumented re.Scanner class now forbids
regular expressions containing capturing
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530)
* freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884)
* freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
* freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533)
* freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531)
* freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534)
* freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.