U-Boot versions prior to 2024.01-6.oe2403sp3 contain buffer overflow vulnerabilities in the nfs_read_reply() and nfs_readlink_reply() functions. These flaws allow a malicious NFS server to send crafted responses that exploit signed integer handling and length validation bypasses, leading to memory corruption and potential bootloader crashes.
NLnet Labs Unbound up to and including version 1.26.1 contains multiple vulnerabilities including a cache-level side-channel that can be exploited under specific non-default configurations, DNSSEC validation bypasses in certain trust-anchor configurations, and a denial-of-service condition via excessive compression pointer traversal. These issues can lead to cache poisoning, incorrect DNSSEC validation resulting in insecure treatment of zones, and performance degradation. A fix is available in version 1.17.1-25.oe2403sp3.
A security vulnerability in libnfs versions prior to 5.0.2-4.oe2403sp3 involves an out-of-bounds write in the ZDR decoding functionality. The flaw occurs because the maxsize parameter supplied by the caller is not properly enforced, affecting functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). This vulnerability has been assigned CVE-2026-108985 and is rated with a high severity score of 7.1.
Multiple security vulnerabilities have been identified in Xwayland, an X server for running X clients under Wayland, including stack-based buffer overflows and use-after-free flaws. These issues affect versions prior to xwayland-24.1.12 and have been fixed in that release. The vulnerabilities include a font alias stack buffer overflow, several use-after-free conditions in XSYNC, and multiple stack buffer overflows related to XKB key types and set map requests. The CVSS score is 7.8, indicating high severity.
Crass is a Ruby CSS parser compliant with the CSS Syntax Level 3 specification. Multiple vulnerabilities affect versions prior to 1.0.8, including improper handling of escaped characters in URLs that may allow CSS-based UI redress or data exfiltration, recursive parsing without depth limits causing stack overflow or excessive memory use, excessive recursion triggered by many adjacent comments leading to denial of service, and inefficient parsing of non-ASCII characters causing high CPU usage and potential denial of service. These issues are fixed in versions 1.0.7 and 1.0.8.
Multiple security vulnerabilities have been identified in the Qt 6 QtBase modules, including null pointer dereference, out-of-bounds reads, and denial-of-service conditions triggered by specially crafted inputs. These affect components such as QCborValue JSON conversion, QAuthenticator NTLM authentication, QDomDocument XML parsing, and HTTP Cache-Control header parsing. The vulnerabilities can lead to application crashes, information disclosure, or denial of service. A security update fixing these issues is available in version 6.5.2-18.oe2403sp3.
Docker Engine contains a vulnerability (CVE-2026-92543) where insecure registry hostnames are classified using an any-match DNS check. This flaw allows an attacker to bypass certificate verification and enable HTTP fallback by exploiting the way loopback and non-loopback IP addresses are handled during registry connections. A fix is available in Docker Engine version 18.09.0-358.oe2403sp3.
A vulnerability in multipath-tools (device-mapper-multipath) allows a local user to trigger an out-of-bounds read by sending a specially crafted command with a format string ending in a trailing percent character to the multipath daemon. This can lead to information disclosure or cause the daemon to crash, resulting in a denial of service. The issue affects versions prior to 0.9.5-22.oe2403sp3 and has been assigned CVE-2026-114038. A fix is available in version 0.9.5-22.oe2403sp3.
Multiple vulnerabilities have been identified in SSSD, a set of daemons managing access to remote directories and authentication mechanisms. These flaws include out-of-bounds memory reads, use-after-free conditions, missing authorization checks, and improper handling of authentication tokens. Exploitation of these vulnerabilities by local attackers can cause denial of service (DoS) conditions by crashing various SSSD responder processes or exhausting memory. Additionally, one vulnerability allows bypassing account expiration controls, enabling unauthorized access. These issues affect versions prior to 2.9.4-34.oe2403sp3 and have been addressed in that fixed release.
A heap-based buffer overflow vulnerability exists in the RPM Package Manager (rpm) due to improper handling of the RPMTAG_FILESIGNATURES header in crafted unsigned RPM packages. This flaw allows an attacker to cause a buffer overflow by providing a tag with an incorrect header type, leading to memory corruption when processed by rpm2cpio, rpm2archive, or rpm -qlvp commands on untrusted packages. The issue is fixed in version 4.18.2-43.oe2403sp3.
Multiple vulnerabilities have been identified in Freedesktop Poppler version 26.07.0, a PDF rendering library. These include a null pointer dereference in JBIG2Stream::rewind, and integer overflows in JBIG2Stream::readCodeTableSeg and FoFiTrueType::mapCodeToGID functions. All vulnerabilities can be triggered remotely and have publicly disclosed exploits. Upgrading to version 26.08.0 or later is recommended to address these issues.
Pylint versions prior to 3.0.3-3.oe2403sp3 contain a vulnerability where an attacker with write access to a shared or untrusted cache directory can execute arbitrary code by replacing a serialized stats cache file. This occurs because Pylint loads module statistics using pickle.load from predictable files under PYLINT_HOME. The issue is fixed in version 3.0.3-3.oe2403sp3.
Multiple security vulnerabilities exist in perl-Cpanel-JSON-XS versions before 4.80-1.oe2403sp3. These include memory leaks from rejected duplicate or malformed keys, type confusion leading to potential crashes or arbitrary pointer dereference, acceptance of malformed UTF-8 in keys causing errors, memory exhaustion via crafted numeric inputs, and out-of-bounds writes during canonical encoding of tied or shared hashes. These flaws can lead to denial of service through process crashes or memory exhaustion, and potentially arbitrary code execution. The issues are fixed in version 4.80-1.oe2403sp3.
A critical buffer overflow vulnerability (CWE-787) has been identified in libwebsockets, a lightweight C library for network protocols. This flaw allows writing data beyond the intended buffer boundaries, impacting confidentiality, integrity, and availability. The vulnerability affects versions prior to 4.3.3-10.oe2403sp3. A patch is available in version 4.3.3-10.oe2403sp3. The CVSS 3.1 score is 8.1, indicating high severity.
An out-of-bounds write vulnerability exists in the Teletext decoder of the ZVBI library versions prior to 0.2.44-3.oe2403sp3. This flaw allows attackers to corrupt memory by sending crafted Teletext streams with unvalidated DRCS pixel-mode values, leading to application crashes.
OpenSSH versions before 9.6p1-25.oe2403sp3 contain a vulnerability where the configuration option value "none" is sometimes incorrectly interpreted as a filename instead of disabling a feature. This issue was fixed in version 9.6p1-25.oe2403sp3.
A vulnerability in rpcbind allows remote unauthenticated attackers to cause a denial of service by sending many unique RPC requests. The service maintains unbounded in-memory lists of previously unseen RPC statistics, causing memory growth and high CPU usage that can degrade or exhaust service availability. This flaw is fixed in rpcbind version 1.2.6-9.oe2403sp3.
Multiple vulnerabilities in OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow crafted EXR files to cause memory corruption issues including integer overflow, out-of-bounds reads and writes, use-after-free, and crashes. These issues affect the decoding and processing of deep tiled EXR files and arise from improper handling of dataWindow origins and buffer size calculations. The vulnerabilities are fixed in versions 3.2.11, 3.3.13, and 3.4.14.
ImageMagick before version 7.1.2.35-1.oe2403sp3 contains a heap-based buffer overflow vulnerability in its -morph image processing feature. This flaw allows an attacker to supply a crafted image that causes writes beyond the bounds of a heap buffer, potentially corrupting memory and crashing the application. The issue has been assigned CVE-2026-119124 and has a medium severity rating with a CVSS score of 4.8. A fix is available in version 7.1.2.35-1.oe2403sp3.
Mtools, a utility suite for accessing MS-DOS disks on Unix-like systems, contains an out-of-bounds write vulnerability in the parse_vses function within vfat.c. This flaw affects versions prior to 4.0.43-3.oe2403sp3 and can lead to a denial of service due to application crash or instability. A fix is available in version 4.0.43-3.oe2403sp3.