Two security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, used in Red Hat Enterprise Linux 9. These include a signed to unsigned conversion error causing a stack-based buffer overflow in NTLM authentication (CVE-2026-0719) and a stack-based buffer overflow in multipart HTTP response parsing (CVE-2026-1761). Red Hat has issued an important security advisory with updates to address these issues. The vulnerabilities are rated as having important security impact, and updated libsoup packages are available for Red Hat Enterprise Linux 9 across multiple architectures.
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.
Security Fix(es):
* fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)
* fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)
* fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for python-Django addresses multiple vulnerabilities including several potential SQL injection flaws, denial-of-service issues, and a username enumeration weakness. The fixes cover injection risks via QuerySet.order_by, FilteredRelation, column aliases with control characters, and raster lookups on PostGIS. Additionally, denial-of-service vulnerabilities in HTML truncation methods and ASGI repeated headers are resolved. A timing-based username enumeration in the mod_wsgi authentication handler is also fixed. These issues were identified and patched by the SUSE Product Security Team.
This security update for libsoup addresses two vulnerabilities: CVE-2026-1536, an HTTP header injection or response splitting issue via CRLF injection in the Content-Disposition header, and CVE-2026-1761, a stack-based buffer overflow caused by incorrect length calculation when parsing multipart HTTP responses. Both vulnerabilities have been fixed in the update.
A security update for python-maturin addresses CVE-2025-58160, which involves log pollution in the tracing-subscriber component. The update fixes this issue in specific SUSE package versions for aarch64 and ppc64le architectures. No CVSS score is provided, but the severity is assessed as medium.
A vulnerability in the RelaxNG parser of libxml2 in certain SUSE packages on the aarch64 architecture allows unbounded recursion when resolving <include> directives. This can lead to call stack exhaustion and cause application crashes. The severity of this issue is assessed as medium.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530)
* freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884)
* freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
* freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533)
* freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531)
* freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534)
* freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for xrdp addresses a potential overflow vulnerability identified as CVE-2025-68670. This issue has been fixed by the SUSE Product Security Team. No specific affected versions are provided. The vulnerability is considered high severity based on the available information.
Wireshark 4.4.13 addresses multiple vulnerabilities including infinite loops and crashes in various protocol dissectors such as MONGO, Kafka, HTTP3, MEGACO, SSH, IEEE 802.11, BLF file parser, and SOME/IP-SD. These issues could cause denial of service conditions through application crashes or hangs. The update fixes these specific issues to improve stability and security.
This security update for glib2 addresses multiple vulnerabilities including buffer underflows, out-of-bounds accesses, and integer overflows in various components such as content type parsing, Base64 encoding, Unicode case conversion, and buffered input stream handling. These issues could lead to memory corruption or crashes. The update fixes these flaws to prevent potential exploitation.
A security update for DPDK addresses a vulnerability (CVE-2025-23259) in the Poll Mode Driver (PMD) that could allow an attacker on a virtual machine within the system to leak information and cause a denial of service on the network interface. The update advances DPDK to version 24.11.4 and also includes non-security related build improvements.
This security update addresses multiple vulnerabilities in the Linux kernel packages used by SUSE and Red Hat Enterprise Linux 9.6 Extended Update Support. The fixes include preventing opcode speculation in io_uring (CVE-2025-21863), resolving a vsock vulnerability that could lead to memory corruption (CVE-2025-40248), and correcting fragment overflow handling in the RX path of the atlantic network driver (CVE-2025-68301). The update requires a system reboot to take effect.
This update for python-filelock fixes the following issues:
- CVE-2025-68146: TOCTOU race condition may allow local attackers to corrupt or truncate arbitrary user files (bsc#1255244).
- CVE-2026-22701: TOCTOU race condition in the SoftFileLock implementation (bsc#1256457).
This update for udisks2 fixes the following issues:
- CVE-2025-8067: Fixed a missing bounds check that could lead to out-of-bounds
read in udisks daemon (bsc#1248502).