This security update for ClamAV addresses multiple vulnerabilities including improper boundary checks, invalid memory frees, integer overflows and underflows, out-of-bounds reads/writes, path traversal, and thread-safety issues. These flaws affect various parsers such as ZIP, PESpin, GPT partition names, PDF hex strings, Mach-O files, XAR, and OneNote notebooks. The update also fixes issues related to NTFS alternate data stream handling on Windows and improves thread safety and resource management in the daemon and cryptographic components.
Multiple security issues were addressed in the yast2-samba-client-5.0.5-1.1 package for openSUSE Tumbleweed. These vulnerabilities relate to the yast2-samba-client component and have been fixed in version 5.0.5-1.1. The issues include CWE-78, which involves improper neutralization of special elements used in OS commands. The severity of these issues is assessed as medium.
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.
A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
Multiple security issues were addressed in the python313-modelscope-hub-0.4.2-1.1 package on the GA media of openSUSE Tumbleweed. The details of the vulnerabilities are not specified. The severity is assessed as medium.
A stack buffer overflow vulnerability exists in the OpenSC software's piv_process_history() function. This flaw allows an attacker with physical access to cause memory corruption by presenting a specially crafted PIV smart card or USB device. The issue affects OpenSC versions prior to 0.27.0. The vulnerability is rated medium severity and no known exploits have been reported in the wild.
This update for libcupsfilters fixes the following issues:
- CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field (bsc#1273145).
- CVE-2026-64612: malformed PNG aborts CUPS image filter process (bsc#1273146).
CVE-2025-46808 is a vulnerability in SUSE neuvector manager versions before 5.4.5 that allows sensitive information to be inserted into the manager container's log files. This exposure could lead to unauthorized disclosure of sensitive data. The vulnerability has a medium severity with a CVSS score of 6.8. It requires low privileges and user interaction to exploit and impacts confidentiality without affecting integrity or availability.
This security update for Tomcat 11 addresses multiple vulnerabilities including security constraint bypass, TOCTOU issues with Unix Domain Socket permissions, incomplete HTTP/2 SNI validation fixes, replay attacks with DIGEST authentication, access control bypasses, memory exhaustion via WebSocket, role reference bypasses, and denial-of-service via HTTP/2 stream reset. The update also includes fixes for session management, authentication, and configuration parsing errors. These vulnerabilities collectively pose risks of unauthorized access, denial of service, and potential privilege escalation. The update corresponds to Tomcat version 11.0.25.
A security update for libzypp and zypper addresses a security issue related to the handling of legacy unsigned repository cache states. The update enforces stricter validation of repository metadata signatures when the repo_gpgcheck setting is enabled, preventing acceptance of unsigned repositories that were previously allowed under legacy exceptions. Additional non-security fixes improve configuration parsing, credential handling, and solver problem logging.
This security update for libzypp and zypper addresses a security issue related to the handling of legacy unsigned repository cache states, enforcing strict signature verification when the repo_gpgcheck setting is enabled. Additional non-security fixes improve configuration parsing, credential handling, and solver problem logging. The update enhances the security posture by preventing acceptance of unsigned repository metadata once strict checking is enabled.
grpc-gateway version 2.28.0 contains an incorrect access control vulnerability involving the processing of the X-HTTP-Method-Override header in ServeMux.ServeHTTP. The application does not properly restrict allowed HTTP methods, which can lead to unintended method overrides when handling POST requests with Content-Type application/x-www-form-urlencoded. This vulnerability is assigned CVE-2026-37236 and is rated medium severity. No patch or CVSS score is currently available, and no known exploits have been reported in the wild.
Multiple security vulnerabilities affecting Mozilla Firefox Extended Support Release (ESR) 140.14.0 and related Thunderbird versions have been addressed in a security update. The issues include privilege escalations, use-after-free bugs, information disclosures, site isolation problems, mitigation bypasses, race conditions, integer overflows, and same-origin policy bypasses across various components such as Graphics, DOM, Networking, JavaScript, and Storage. These vulnerabilities were fixed in Firefox ESR 140.14.0 and corresponding Thunderbird packages.
A heap out-of-bounds write vulnerability exists in the IMA/DVI ADPCM decoder component of the gstreamer1-plugins-bad-free package, part of the GStreamer streaming media framework. This vulnerability is tracked as CVE-2026-19387 and affects multiple versions of Red Hat Enterprise Linux and SUSE distributions. The flaw could potentially lead to memory corruption. A security update addressing this issue has been released by Red Hat.
A symlink-following vulnerability in libvirt's virFileChownFiles() function allows a local attacker running as the confined swtpm user to escalate privileges. By placing a symbolic link in the swtpm state directory, the attacker can cause the root-level libvirt daemon to change ownership of arbitrary files to the swtpm user, potentially gaining root-level file ownership control. This vulnerability affects multiple specific Ubuntu package versions of libvirt.
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.
Multiple security vulnerabilities have been addressed in the multipath-tools package by SUSE, including heap out-of-bounds reads, path traversal, heap buffer overflows, and denial of service conditions. These issues affect various components such as the custom format string parser, device-mapper-multipath management, SCSI PRIN READ FULL STATUS responses, IPC send operations, GPT header validation, and multipathd socket handling. The update to version 0.12.4+278+suse.9cf9c5c includes fixes for these vulnerabilities and adds a missing NULL check in the DM parser.
This security update for the Trivy tool addresses multiple vulnerabilities across several dependencies, including improper certificate validation, HTTP method override bypass, denial of service via oversized inputs, information disclosure through crafted tarball hardlinks, authentication bypass and deadlocks in SSH libraries, authorization bypass due to header case mismatches, heap memory exhaustion, and denial of service from missing headers in gRPC servers. These issues collectively pose risks ranging from low to potentially higher impact depending on context. The update fixes these issues to improve overall security.
This security update for multipath-tools addresses multiple vulnerabilities including heap out-of-bounds reads, path traversal, heap buffer overflows, local denial of service, and socket exhaustion. The update fixes issues in custom format string parsing, device-mapper-multipath failed_wwids management, SCSI PRIN READ FULL STATUS responses, IPC send operations, GPT header validation, and ALUA RTPG parsing. The update also adds a missing NULL check in the DM parser. These vulnerabilities could lead to information disclosure, denial of service, or memory corruption.