Search: 16.5-2

Multiple security issues were addressed in the traefik-3.7.16-1.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the Traefik component within this distribution. No specific vulnerabilities or impacts are detailed in the available information.

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010) * gcc: libstdc++ integer overflow in `new` operator (CVE-2026-95619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A moderate severity vulnerability in BIND 9 allows denial of service via crafted DNSSEC responses. This affects BIND versions prior to 9.16.23-40.el9_8.12. A security update is available from Red Hat to address this issue.

Starman versions before 0.4019 for Perl contain a vulnerability that allows remote attackers to exhaust worker memory by sending chunked HTTP request bodies with unbounded chunk sizes. The chunked body decoder buffers each chunk in memory without limiting the length of the chunk-size line, enabling a single connection to cause memory exhaustion.

Starman versions before 0.4019 for Perl incorrectly send response bodies for HEAD requests, causing desynchronization of responses on keep-alive connections. This includes responses with status codes 1xx, 204, or 304, which also carry a body improperly. As a result, clients may misinterpret response data, and front-end proxies reusing upstream connections may associate responses with incorrect requests.

Starman versions before 0.4019 for Perl contain a vulnerability that allows remote attackers to cause CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. The issue arises because the regex used to match chunk-size lines does not handle certain line endings correctly, leading to excessive backtracking and CPU usage. This can be triggered by sending specially crafted requests to any route.

Starman versions before 0.4019 for Perl have a vulnerability where a stalled request body can indefinitely hold a worker thread, causing denial of service. This occurs because the read_timeout setting only applies to headers, while the body is read with blocking calls without a deadline. An attacker can exploit this by sending complete headers and then stalling or trickling the request body, tying up workers until they disconnect. Version 0.4019 introduces fixes by applying read_timeout to body reads and adding a body_timeout limit of 300 seconds.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a heap-based buffer overflow vulnerability in the X11 animate operation. This flaw allows an attacker to supply a crafted image that, when processed with the X11 animate operation, can overwrite heap memory and crash the application. The vulnerability has a low severity score and does not impact confidentiality or integrity but can cause denial of service through application crashes.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a memory leak vulnerability in the handling of the -cdl (color decision list) option. This flaw causes allocated memory not to be freed after use, potentially leading to resource exhaustion if exploited repeatedly. The vulnerability has a low severity rating and a CVSS score of 3.3. No known exploits are reported in the wild.

ImageMagick versions before 7.1.2-33 contain a memory leak vulnerability in the magick compare command. This flaw occurs due to missing cleanup when an operation fails, allowing attackers to trigger repeated failed compare operations that exhaust memory and cause denial of service. The vulnerability has a low severity score and does not impact confidentiality or integrity.

ImageMagick versions before 7.1.2-33 contain a memory leak vulnerability in the PerlMagick component. This flaw causes failure to free memory when reading image properties, allowing attackers to repeatedly trigger property reads and exhaust memory, resulting in denial of service.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability triggered by the use of the -set profile option. This flaw can cause memory exhaustion and potentially lead to denial of service if an attacker convinces a user to process crafted images using this option. The vulnerability has a low severity rating with a CVSS score of 3.3.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the handling of XMP profiles by various decoders. An attacker can supply images with crafted XMP profiles that cause memory to leak each time they are processed, potentially leading to resource exhaustion and denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.3.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a memory leak vulnerability in their XML parsing code. The leak occurs when parsing reaches the nesting depth limit, causing allocated memory not to be released. An attacker can exploit this by supplying crafted deeply nested XML data to trigger memory exhaustion, resulting in a denial of service condition.

ImageMagick versions before 7.1.2-33 contain a heap buffer overflow vulnerability affecting 32-bit systems. This flaw occurs when convex-hull information is requested, allowing attackers to supply crafted images that trigger heap memory corruption. The vulnerability can cause application crashes and may potentially allow code execution.

ImageMagick versions before 7.1.2-33 have a memory leak vulnerability in the MAT image decoder. This flaw occurs because allocated memory is not released in a specific error path. An attacker can exploit this by supplying crafted MAT files that repeatedly trigger the error, causing gradual memory consumption in the process.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the JNG encoder. This flaw causes allocated memory to not be released when processing crafted JNG images, potentially leading to resource exhaustion and a limited denial of service.

ImageMagick versions prior to 7.1.2-33 contain a memory leak vulnerability in the FPX encoder. This flaw allows attackers to supply crafted FPX images that cause repeated memory leaks, leading to resource exhaustion and denial of service. The vulnerability has a low severity rating and does not impact confidentiality or integrity.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a stack-based buffer overflow vulnerability in the handling of bzip2 compressed images. This flaw allows attackers to supply crafted bzip2 compressed images that can overwrite stack memory during decoding, potentially causing crashes or memory corruption. The vulnerability has a high severity rating with a CVSS score of 8.1.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have an injection vulnerability in the MVG encoder. This flaw allows attackers who can supply drawing options to inject arbitrary MVG drawing commands into generated MVG files. The vulnerability has a low severity with a CVSS score of 3.6 and requires local access with user interaction for exploitation.