This security update for freeciv addresses multiple issues including a heap buffer overflow and an out-of-bounds read triggered by crafted save files. Additional fixes improve game logic, logging, and user interface behavior. The update resolves vulnerabilities that could potentially lead to memory corruption. No known exploits are reported in the wild.
CVE-2025-55154 is an integer overflow vulnerability in ImageMagick affecting MNG magnification. It is addressed in the GraphicsMagick-1.3.48-2.1 package on openSUSE Tumbleweed and related Red Hat Enterprise Linux 7 Extended Lifecycle Support packages. The issue could lead to security risks if exploited. Red Hat has released an important security update fixing this vulnerability in ImageMagick 6.9.10.68-8.el7_9. No known exploits are reported in the wild. The vulnerability is rated medium severity.
This security update for NetworkManager addresses two vulnerabilities: CVE-2026-10805, a local privilege escalation via malformed MUD URLs in the dhclient backend, and CVE-2026-19685, a missing user ownership check for 802.1X directory properties that can allow WPA-Enterprise server certificate validation bypass. The update is rated with high severity and affects certain versions of NetworkManager in SUSE and Red Hat Enterprise Linux 9 distributions.
A stack buffer overflow vulnerability exists in the rpcinfo rpcbdump() short-mode version-list formatting in the SUSE rpcbind package. This vulnerability is identified as CVE-2026-16461 and has medium severity. It affects specific SUSE rpcbind package versions on aarch64 and ppc64le architectures. No CVSS score is provided, and no patch or remediation details are included in the available data.
A security update for the perl-URI package addresses CVE-2026-19953, which involves improper normalization in the nameprep process leading to non-NFC host names being encoded into non-standard punycode labels. This issue affects SUSE Linux Enterprise Server 16.0 versions of perl-URI prior to 5.310.0-160000.3.1. The vulnerability is rated medium severity.
This security update for Chromium addresses multiple critical vulnerabilities across versions 152.0.7977.75 and 152.0.7977.82. The fixes cover a range of issues including use-after-free, type confusion, out-of-bounds reads and writes, improper input validation, incorrect authorization, information leaks, race conditions, and buffer overflows in various components such as V8, WebGL, Skia, CacheStorage, DevTools, and others. These vulnerabilities could potentially allow attackers to execute arbitrary code, escalate privileges, or leak sensitive information. The update also disables the EULA dialog to use preferences instead of a hardcoded return. The affected versions are specifically identified and patches are available in these updated Chromium releases.
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
Multiple security issues were addressed in the ollama-0.33.1-1.1 package included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities fixed are not detailed in the provided information. The severity of these issues is assessed as medium.
A local privilege escalation vulnerability (CVE-2026-16742) exists in systemd-homed due to missing home record signature verification during authentication. This flaw affects specific SUSE systemd packages version 257.13-160000.4.1.aarch64 and could allow a local attacker to escalate privileges. Additionally, a non-security issue causing systemd-resolved to fail to start due to denied write access to tmpfs is fixed in the same update. The vulnerability is rated medium severity. No CVSS score is available.
Multiple security vulnerabilities exist in GNU cpio, including a path traversal flaw that permits creation of hard links outside the intended extraction directory, improper memory management causing denial of service, and terminal control sequence injection via crafted archive member names. These vulnerabilities can lead to unauthorized file modifications, denial of service, or terminal manipulation when extracting malicious archives. Vendors such as Red Hat have issued updates to address these issues. Users are advised to avoid using the --no-absolute-filenames option with untrusted archives and to apply available patches.
A security update for python-apprise addresses CVE-2026-59180, which involves information disclosure through HTTP redirects that cause credentials to be resent. The vulnerability is rated as low severity. Multiple specific versions of python-apprise used in SUSE and Ubuntu distributions are affected.
This security update for the lkl component addresses unspecified issues by updating it to match the current kernel version. No specific vulnerabilities or technical details are provided.
A security update for the lkl component has been released by SUSE Product Security Team. The update aligns lkl with the current kernel version, addressing unspecified security issues. No specific affected versions or detailed vulnerability information are provided.
Multiple vulnerabilities in libvirt have been addressed by a security update. These include an integer overflow leading to heap buffer overflow and possible local privilege escalation, newline injection enabling dnsmasq configuration directive injection and potential arbitrary code execution as root, symlink-following allowing privilege escalation via ownership changes, temporary world-readable volume images risking sensitive information disclosure, and root chown() symlink-following leading to privilege escalation. The affected versions are specific builds of libvirt as listed. The severity of these combined issues is high.
Multiple privilege escalation vulnerabilities affecting Intel processors are addressed by a security update to the ucode-intel microcode package. These vulnerabilities involve improper value and memory range handling in privileged CPU modes, specifically Ring 0 and System Management Mode (SMM). The update is available for SUSE and Red Hat Enterprise Linux distributions, including microcode releases up to 20260812. The vulnerabilities are identified as CVE-2025-31936 and CVE-2025-35973. The update fixes these issues by providing updated microcode and related packages.
Multiple security issues were addressed in the python313-aiosmtpd-1.4.6-6.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by CVE-2024-27305 and CVE-2024-34083. The package update is part of the SUSE Product Security Team's efforts to improve security in this component.