U-Boot before version 2021.10-14.oe2203sp4 contains buffer overflow vulnerabilities in the nfs_read_reply() and nfs_readlink_reply() functions. These flaws allow a malicious NFS server to send crafted replies that exploit signed integer handling errors, leading to memory corruption and potential bootloader crashes.
Multiple vulnerabilities affect NLnet Labs Unbound up to and including version 1.26.1. These include a cache-level side-channel vulnerability that can leak upstream source port information under specific non-default configurations, DNSSEC validation bypasses that can cause trust islands to be treated as insecure, and a resource exhaustion issue from chained compression pointers that can degrade performance. These issues can facilitate cache poisoning, denial of existence for DNS records, and performance degradation. A fix is available in version 1.13.2-31.oe2203sp4.
Multiple security vulnerabilities have been identified in Xwayland, the X server for running X clients under Wayland, including stack-based buffer overflows and use-after-free issues. These vulnerabilities affect versions prior to xwayland-24.1.12 and have been fixed in that release. The issues include a font alias stack buffer overflow, several XKB-related stack buffer overflows, and multiple use-after-free vulnerabilities in XSYNC components. The vulnerabilities have a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. A security update is available in xorg-x11-server-Xwayland-22.1.2-38.oe2203sp4. No known exploits in the wild have been reported.
Multiple security vulnerabilities affect rubygem-crass, a Ruby CSS parser compliant with CSS Syntax Level 3. Prior to version 1.0.8, Crass incorrectly handles closing parentheses after escaped backslashes in bad URLs, potentially allowing CSS-based UI redress or data exfiltration, though not script execution. Versions before 1.0.7 suffer from unbounded recursion in parsing nested CSS blocks and functions, leading to denial of service via stack overflow or excessive memory use. Additionally, recursive comment parsing and inefficient handling of non-ASCII characters can cause excessive CPU consumption or crashes. These issues are fixed in versions 1.0.7 and 1.0.8.
Multiple critical vulnerabilities in the Linux kernel have been resolved, including a use-after-free issue in the CAN esd_usb driver, an extent movement flaw in OCFS2, an off-by-one error in NTFS mapping pairs decoding, an out-of-range enum validation in hdac_hdmi codec driver, and a memory leak in the SMC LLC event handler. These flaws could lead to memory corruption, data loss, or denial of service. The vulnerabilities are fixed in Linux kernel version 5.10.0-340.0.0.241.oe2203sp4.
A vulnerability in multipath-tools (device-mapper-multipath) allows a local user to cause an out-of-bounds read by sending a specially crafted command with a format string ending in a trailing percent character to the multipath daemon. This can lead to information disclosure or cause the daemon to crash, resulting in a denial of service. The issue affects versions prior to 0.8.7-30.oe2203sp4 and has been assigned CVE-2026-114038.
Multiple vulnerabilities have been identified in SSSD, a system service managing access to remote directories and authentication. These flaws include out-of-bounds memory reads, use-after-free, integer underflows, missing authorization checks, and memory leaks. Exploitation by local attackers can lead to denial of service (DoS) conditions, memory exhaustion, and unauthorized access due to account expiration bypass. The issues affect configurations where autofs responder, Kerberos Credential Manager, PAM responder, and NSS responder services are enabled. A security update fixing these vulnerabilities is available in version 2.6.1-38.oe2203sp4.
A heap-based buffer overflow vulnerability exists in the RPM Package Manager (rpm) due to improper handling of the RPMTAG_FILESIGNATURES header type in crafted, unsigned RPM packages. This flaw allows an attacker to cause a buffer overflow when the hex2binv() function allocates an insufficient buffer and writes attacker-controlled data beyond its bounds. The vulnerability can be triggered using rpm2cpio, rpm2archive, or rpm -qlvp commands on a malicious package. A fix is available in version 4.17.0-54.oe2203sp4.
Multiple vulnerabilities have been identified in Freedesktop Poppler version 26.07.0, a PDF rendering library. These include a null pointer dereference in JBIG2Stream::rewind, and integer overflows in JBIG2Stream::readCodeTableSeg and FoFiTrueType::mapCodeToGID. All vulnerabilities can be exploited remotely and have publicly available exploits. Upgrading to version 26.08.0 or later addresses these issues.
Pylint versions from 0.15.2 up to but not including 4.0.9 contain a vulnerability where module statistics are stored in predictable cache files and loaded using pickle. An attacker with write access to a shared or group-writable cache directory can replace these cache files with malicious serialized data, leading to arbitrary code execution with the privileges of the user running Pylint. This issue is fixed in version 4.0.9.
A critical buffer overflow vulnerability (CWE-787) has been identified in libwebsockets, a lightweight C library for network protocols. This flaw allows writing data outside the intended buffer boundaries, impacting confidentiality, integrity, and availability. The vulnerability affects versions prior to 4.3.0-13.oe2203sp4. A fix is available in version 4.3.0-13.oe2203sp4. The CVSS v3.1 base score is 8.1, indicating high severity.
OpenSSH versions before 8.8p1-52.oe2203sp4 contain a vulnerability where the configuration option value "none" is sometimes incorrectly interpreted as a filename instead of disabling a feature. This issue is fixed in version 8.8p1-52.oe2203sp4.
A vulnerability in rpcbind allows a remote unauthenticated attacker to cause a Denial of Service (DoS) by sending many unique RPC requests. The service tracks unseen RPC statistics in unbounded memory lists, causing persistent memory growth and high CPU usage, which can degrade or exhaust service availability. A fix is available in version 1.2.6-9.oe2203sp4.
ImageMagick before version 7.1.2-35-1.oe2203sp4 contains a heap-based buffer overflow vulnerability in its -morph image processing feature. This flaw allows crafted images to cause writes beyond the bounds of a heap buffer, potentially corrupting memory and crashing the application when processed with the -morph option.
Mtools, a utility suite for accessing MS-DOS disks on GNU and Unix systems, has a security vulnerability (CVE-2026-118384) involving an out-of-bounds write in the parse_vses function within vfat.c. This flaw affects versions prior to 4.0.35-3.oe2203sp4 and can lead to a denial of service due to application crash. A fix is available in version 4.0.35-3.oe2203sp4.
A denial of service vulnerability exists in dnspython prior to version 2.9.0 due to unbounded traversal of DNS compression pointer chains during name decompression. This can cause high CPU usage and application degradation when processing malicious DNS messages. The issue is fixed in dnspython version 2.9.0.
libsoup, an HTTP client/server library for GNOME, has multiple security flaws related to WebSocket frame handling. These include improper signal emission causing heap corruption or crashes, inadequate size checks during message reassembly leading to heap corruption, and a heap buffer overflow when constructing masked client frames with large payloads. These vulnerabilities affect versions prior to 2.74.2-28.oe2203sp4 and have been assigned CVE-2026-102556 among others. A high-severity fix is available in version 2.74.2-28.oe2203sp4.
Multiple security vulnerabilities have been identified in BIND 9 DNS server versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26, including variants with the -S1 suffix. These include excessive resource consumption from specially crafted DNS messages, memory corruption and potential remote code execution via replayed GSS-TSIG signed UDP messages, assertion failures causing server aborts when processing redirect zones with qname-minimization strict enabled, and denial of service from recursive query handling with specific RPZ zone configurations. A fixed version 9.16.23-34.oe2203sp4 is available addressing these issues.
A critical heap memory corruption vulnerability exists in the FlashPix JPEG-tile decoder of the python-pillow library prior to version 13.0.0. This flaw allows crafted OLE2 FlashPix files to cause buffer overflows during image decoding, potentially enabling arbitrary code execution. The issue is fixed in version 13.0.0.
A vulnerability in the tftp-hpa client (Trivial File Transfer Protocol) allows remote unauthenticated attackers to cause a denial of service. The flaw occurs when the in.tftpd remap engine processes an inverse remap rule that aborts with a non-empty custom error message, leading to out-of-bounds read/write operations. This can crash the daemon. The issue is fixed in version 5.2-33.oe2203sp4.