U-Boot versions before 2024.01-6.oe2403sp1 contain buffer overflow vulnerabilities in the nfs_read_reply() and nfs_readlink_reply() functions. These flaws allow a malicious NFS server to send crafted replies that exploit signed integer handling errors, leading to memory corruption and potential bootloader crashes. The vulnerabilities are fixed in version 2024.01-6.oe2403sp1.
Multiple security vulnerabilities affect NLnet Labs Unbound up to and including version 1.26.1. These include a cache-level side-channel vulnerability that can leak upstream source port information under specific configurations, DNSSEC validation bypasses that can cause trust islands to be treated as insecure, and a performance degradation issue via chained compression pointers. These flaws can lead to cache poisoning, denial of DNS record existence, and degraded resolver performance. A fix is available in version 1.17.1-25.oe2403sp1.
A high-severity vulnerability (CVE-2026-108985) exists in libnfs versions prior to 5.0.2-4.oe2403sp1. The flaw is an out-of-bounds write in the ZDR decoding functionality related to lib/libnfs-zdr.c, where the maxsize parameter supplied by the caller is not properly enforced. This can lead to integrity loss and denial of service. A patch fixing this issue is available in version 5.0.2-4.oe2403sp1.
Multiple security vulnerabilities have been identified in X.Org X server and Xwayland prior to versions 21.1.23 and 24.1.12 respectively. These include stack-based buffer overflows in font alias resolution and XKB key type handling, as well as several use-after-free vulnerabilities in XSYNC components. The vulnerabilities could allow local attackers with limited privileges to cause memory corruption leading to potential code execution or denial of service. Fixes have been released in xorg-server-21.1.23 and xwayland-24.1.12.
rubygem-crass is a Ruby CSS parser compliant with CSS Syntax Level 3. Multiple vulnerabilities affect versions prior to 1.0.8, including improper handling of bad URLs that can allow CSS-based UI redress or data exfiltration without script execution, and denial-of-service conditions caused by recursive parsing of deeply nested blocks, excessive adjacent comments, or inefficient handling of non-ASCII characters. These issues are fixed in versions 1.0.7 and 1.0.8.
Multiple security vulnerabilities have been identified in the Qt 6 QtBase software toolkit, including NULL pointer dereference, out-of-bounds reads, and denial-of-service conditions affecting various Qt Core and Qt Network modules. These issues can lead to application crashes and potential exposure of sensitive information when processing crafted inputs or interacting with malicious servers. The vulnerabilities affect versions prior to 6.5.2-18.oe2403sp1 and have been addressed in that fixed release.
Docker Engine has a vulnerability (CVE-2026-92543) where its handling of insecure registry hostnames can be bypassed due to improper DNS and CIDR matching logic. This flaw allows an attacker to disable certificate verification and enable HTTP fallback by manipulating DNS responses to include both loopback and attacker IP addresses.
A vulnerability in multipath-tools (device-mapper-multipath) allows a local user to cause an out-of-bounds read by sending a specially crafted command with a format string ending in a trailing percent character to the multipath daemon. This can lead to information disclosure or cause the daemon to crash, resulting in a denial of service. The issue affects versions prior to 0.9.5-22.oe2403sp1 and has been assigned CVE-2026-114038. A patch is available in version 0.9.5-22.oe2403sp1.
Multiple vulnerabilities have been identified in SSSD, a set of daemons managing access to remote directories and authentication mechanisms. These flaws include out-of-bounds memory reads, use-after-free, integer underflows, missing authorization checks, and improper handling of authentication tokens. Exploitation can lead to denial of service (DoS) conditions by crashing various SSSD responder processes or exhausting memory. Additionally, one vulnerability allows bypassing account expiration controls, enabling unauthorized access. These issues affect local attackers with varying privileges. A security update fixing these vulnerabilities is available in version 2.9.4-34.oe2403sp1.
A heap-based buffer overflow vulnerability exists in the RPM Package Manager (RPM) due to improper handling of the RPMTAG_FILESIGNATURES header in crafted, unsigned RPM packages. This flaw allows an attacker to cause a buffer overflow by declaring the header with an incorrect type, leading to out-of-bounds memory writes during hex decoding. The issue can be triggered via rpm2cpio, rpm2archive, and rpm -qlvp commands when processing untrusted packages. A fix is available in version 4.18.2-43.oe2403sp1.
Multiple vulnerabilities have been identified in Freedesktop Poppler version 26.07.0, a PDF rendering library. These include a null pointer dereference in JBIG2Stream::rewind, and integer overflows in JBIG2Stream::readCodeTableSeg and FoFiTrueType::mapCodeToGID. The vulnerabilities can be exploited remotely and public exploit code exists. Upgrading to version 23.12.0-15.oe2403sp1 or later addresses these issues.
Pylint versions prior to 3.0.3-3.oe2403sp1 contain a vulnerability where module statistics are stored in predictable cache files and loaded using pickle.load. An attacker with write access to a shared or group-writable cache directory can replace these cache files with malicious serialized data, leading to arbitrary code execution with the privileges of the user running Pylint. This issue is fixed in version 3.0.3-3.oe2403sp1.
perl-Cpanel-JSON-XS versions before 4.80-1.oe2403sp1 contain multiple security vulnerabilities including memory leaks, type confusion, memory exhaustion, and out-of-bounds writes. These issues arise from improper handling of duplicate keys, malformed UTF-8 in keys, large numeric exponents, incremental parsing buffers, and canonical encoding of tied or shared hashes. The vulnerabilities can lead to process crashes, memory exhaustion, and potential denial of service. A fixed version 4.80-1.oe2403sp1 is available addressing these issues.
A critical buffer overflow vulnerability (CWE-787) exists in libwebsockets prior to version 4.3.3-10.oe2403sp1. This flaw allows writing data beyond the intended buffer boundaries, impacting confidentiality, integrity, and availability. A fix is available in version 4.3.3-10.oe2403sp1.
OpenSSH versions before 9.6p1-25.oe2403sp1 contain a vulnerability where the configuration option value "none" is sometimes incorrectly interpreted as a filename instead of disabling a feature. This issue has been fixed in version 9.6p1-25.oe2403sp1.
A vulnerability in rpcbind allows remote unauthenticated attackers to cause a Denial of Service (DoS) by sending many unique RPC requests. The service records these requests in unbounded in-memory lists, leading to memory exhaustion and high CPU usage, which degrades or exhausts service availability. This issue affects rpcbind versions prior to 1.2.6-9.oe2403sp1 and has been assigned CVE-2026-94640. A fix is available in version 1.2.6-9.oe2403sp1.
OpenEXR, a widely used HDR image file format implementation, has multiple vulnerabilities affecting versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 on ILP32 builds. These include an out-of-bounds read triggered by crafted uncompressed deep-tile EXR files causing denial of service, and a heap out-of-bounds write in the exrmultiview utility when combining two crafted scanline EXR files with misaligned union dataWindows. Both issues are fixed in versions 3.2.11, 3.3.13, and 3.4.14.
ImageMagick versions prior to 7.1.2.35-1.oe2403sp1 contain a heap-based buffer overflow vulnerability in the -morph processing feature. This flaw allows an attacker to supply a crafted image that causes writes beyond the bounds of a heap buffer, potentially corrupting memory and crashing the application. The vulnerability has a medium severity score of 4.8 and is fixed in version 7.1.2.35-1.oe2403sp1.
Mtools, a utility suite for accessing MS-DOS disks on Unix-like systems, contains an out-of-bounds write vulnerability in the parse_vses function within vfat.c. This flaw affects versions prior to 4.0.43-3.oe2403sp1 and can lead to a denial of service due to application crash. The issue has been fixed in version 4.0.43-3.oe2403sp1.
A vulnerability in dnspython prior to version 2.9.0 allows an attacker to cause excessive pointer traversal during DNS name decompression, leading to high CPU usage and potential denial of service. The issue is fixed in version 2.9.0.