Qt6-qtbase contains a denial-of-service vulnerability in its QDomDocument XML parsing component and an out-of-bounds read vulnerability in HTTP Cache-Control header parsing within the QtNetwork module. The Cache-Control header parsing flaw affects Qt versions from 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1 on 64-bit builds, allowing remote attackers to cause application crashes via a crafted HTTP response header. The vulnerability is fixed in version 6.5.2-18.oe2403sp4.
Multiple vulnerabilities in the SSSD autofs responder UNIX socket allow local attackers to cause denial of service (DoS) conditions. These include out-of-bounds memory reads due to improper buffer offset calculation and integer underflow, as well as memory exhaustion from unreleased allocations during request processing. These flaws can crash the autofs responder process or exhaust memory, disrupting service availability.
A vulnerability in rpcbind allows a remote unauthenticated attacker to cause a Denial of Service (DoS) by sending many unique RPC requests. The service tracks new RPC statistics in unbounded memory lists, causing persistent memory growth and high CPU usage, which can degrade or exhaust service availability. This flaw is fixed in rpcbind version 1.2.6-9.oe2403sp4.
OpenEXR, a widely used HDR image file format implementation, has multiple vulnerabilities affecting versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 on ILP32 builds. These include an out-of-bounds read triggered by crafted uncompressed deep-tile EXR files leading to denial of service, and a heap out-of-bounds write in the exrmultiview utility when combining certain crafted scanline EXR files. These issues are fixed in versions 3.2.11, 3.3.13, and 3.4.14.
ImageMagick versions before 7.1.2-35-1.oe2403sp4 contain a heap-based buffer overflow vulnerability in the -morph image processing feature. This flaw allows crafted images to cause out-of-bounds heap writes, potentially crashing the application. The issue is fixed in version 7.1.2-35-1.oe2403sp4. The vulnerability has a medium severity score of 4.8 and does not have known exploits in the wild.
FreeRDP versions before 2.11.8-11.oe2403sp4 contain multiple security vulnerabilities including heap buffer overflows, out-of-bounds reads, and uninitialized heap memory disclosures. These flaws arise from improper validation and handling of RDP protocol messages such as Server Redirection PDUs, URBDRC channel messages, and RPC gateway transport parser data. Exploitation can lead to client crashes, denial of service, information disclosure, and potentially remote code execution when combined with other vulnerabilities. The issues are fixed in version 2.11.8-11.oe2403sp4.
A cryptographic vulnerability was identified in Mozilla Firefox's Security Block-lists, Allow-lists, and other State component. This issue affects versions prior to Firefox 153.5.1-1.oe2403sp4 and was addressed in Firefox 158.0.1 and related ESR and Thunderbird versions. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level. No known exploits are reported in the wild.
A security vulnerability in GNU Emacs before version 29.1-12.oe2403sp4 allows OS command injection via a filename due to an incomplete list of disallowed inputs in tramp-user-regexp. This issue is a regression from an incomplete fix for a previous vulnerability (CVE-2026-79992).
A heap out-of-bounds (OOB) write vulnerability exists in the Mutt email client in the convert_file_from_to() function. This flaw can be triggered via a crafted Content-Type header when an email is used as a template. The issue affects versions prior to 2.3.2-2.oe2403sp4 and has a low severity rating.
xdg-dbus-proxy versions before 0.1.2-3.oe2403sp4 contain a vulnerability that allows bypassing message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. This flaw can be exploited by a malicious or compromised Flatpak app to execute arbitrary code outside its sandbox. The issue arises from incorrect message filtering implementation. A fix is available in version 0.1.2-3.oe2403sp4.
Multiple security vulnerabilities exist in Apache HTTP Server mod_auth_digest before version 2.4.69. These include missing authentication checks allowing unauthenticated denial of service, authentication bypass via replay attacks under certain configurations, and use-after-free conditions causing authentication state corruption. All issues are resolved in version 2.4.69.
PipeWire versions prior to 0.3.63-7.oe2403sp4 contain a vulnerability involving multiple unbounded alloca() calls in the PulseAudio protocol server. This flaw allows an attacker with limited permissions inside a sandboxed environment, such as Flatpak, to escape the sandbox by loading a malicious library via PipeWire's PulseAudio compatibility layer. Successful exploitation can lead to arbitrary code execution outside the sandbox and compromise of the user's system. A patch fixing this issue is available in version 0.3.63-7.oe2403sp4.
GNU Aspell versions prior to 0.60.8.1-2.oe2403sp4 contain multiple heap-based buffer overflow and out-of-bounds read vulnerabilities in their dictionary loading and decompression components. These flaws allow an attacker to cause heap memory corruption, denial of service, memory disclosure, and potentially remote code execution by tricking a user into loading crafted dictionary or compressed files. The issues are fixed in version 0.60.8.1-2.oe2403sp4 and later.
A vulnerability in python-urllib3 versions prior to 1.26.18-11.oe2403sp4 allows HTTPS proxy TLS settings to be incorrectly shared with target-server TLS settings. This can lead to an attacker impersonating the HTTPS proxy and intercepting or modifying forwarded traffic. The issue is fixed in version 1.26.18-11.oe2403sp4.
A shell command injection vulnerability exists in libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 when built with the libssh2 SSH backend. The vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters. This occurs due to improper escaping in the gen_proto() function, which inserts the repository path directly into a shell command string. The issue can be triggered by crafting a malicious submodule URL in a .gitmodules file during a recursive clone operation.
A vulnerability in GNU patch allows an attacker to create arbitrary files outside the intended directory by using a specially crafted patch file. This occurs due to missing validation of absolute file paths during automatic patch reversal, enabling file creation with the permissions of the executing user. The flaw affects versions prior to 2.7.6-24.oe2403sp4 and has a medium severity rating.
Libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser that can be exploited remotely to cause a denial of service (CVE-2026-95114). This vulnerability is addressed in version 4.3.3-9.oe2403sp4. The issue has a high severity rating with a CVSS score of 7.5, indicating a significant impact on availability but no impact on confidentiality or integrity.
Multiple security issues were identified in libXi, the client-side library for the X Input Extension, leading to a high-severity vulnerability tracked as CVE-2026-109089. These issues affect versions prior to 1.8.1-6.oe2403sp4. A security update has been released to address these vulnerabilities.
Multiple denial of service vulnerabilities exist in HDF5 before version 2.3.0, including untrusted pointer dereference, NULL pointer dereference, out-of-bounds heap read, and size underflow issues. These flaws affect various components such as the h5dump tool, fill value handling, N-Bit filter processing, and Fletcher32 checksum calculation. The vulnerabilities can be triggered by crafted HDF5 files and may cause application crashes or memory disclosure in constrained cases. A security update fixing these issues is available in version 1.14.5-8.oe2403sp4.
A critical buffer overflow vulnerability exists in the Brotli decoder used by python-brotlicffi versions prior to 1.1.0.0-2.oe2403sp4. This flaw allows a remote unauthenticated attacker to corrupt memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Users should update to fixed versions 1.1.0.0-2.oe2403sp4 or later to mitigate the risk.