Threats Tagged 'suse-product-security-team'

This security update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 addresses multiple vulnerabilities affecting various kernel components including netfilter, ip6_tunnel, ALSA pcm, bonding, and SMB client. The fixes resolve issues such as invalid packet handling, use-after-free conditions, and improper user-space input acceptance. These vulnerabilities were collectively addressed in Live Patch 74 for SUSE Linux Enterprise 12 SP5.

These are all security issues fixed in the patch-2.8-3.1 package on the GA media of openSUSE Tumbleweed.

This security update for libexif addresses three vulnerabilities involving integer overflow and underflow in the handling and decoding of MakerNotes, specifically affecting Nikon MakerNote processing. These issues could lead to information disclosure, crashes, and denial of service. The update fixes CVE-2026-40385, CVE-2026-40386, and CVE-2026-32775. No CVSS score is provided, but the impact includes medium severity issues such as crashes and information leaks.

A security update for the SUSE Linux Enterprise 11 SP4 kernel addresses multiple vulnerabilities, including use-after-free bugs, race conditions, and improper handling of network protocols. The update fixes 10 distinct CVEs affecting components such as SCSI, TCP, bonding, ALSA, KVM, networking, and Bluetooth subsystems. These vulnerabilities could lead to memory corruption or unexpected behavior in kernel modules.

This update for gstreamer-plugins-good fixes the following issue - CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).

This security update for Apache2 addresses multiple vulnerabilities including use-after-free, cross-site scripting (XSS), buffer overflows, out-of-bound reads, improper privilege management, denial of service, and resource exhaustion issues across various modules such as mod_ldap, mod_proxy_ftp, mod_proxy_html, mod_ssl, and mod_http2. The update fixes 13 distinct CVEs that could lead to crashes, unauthorized reads, heap-based buffer overflows, and denial of service conditions.

A security update for golang-github-docker-libnetwork addresses CVE-2026-2808, which involves unvalidated user-supplied file paths in github.com/hashicorp/consul. This vulnerability can lead to arbitrary file reads through the Vault Kubernetes authentication provider. The issue was identified and fixed by the SUSE Product Security Team. No specific affected versions are provided. No known exploits are reported in the wild. The severity is assessed as medium.

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Security Fix(es): * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An out-of-bounds read vulnerability (CWE-125) exists in the VA JPEG decoder component of the gst-plugins-bad package used by GStreamer on Red Hat Enterprise Linux 10. The vulnerability occurs because the JPEG parser reads a segment length from the bitstream without validating it against the available input data. This can lead to reading beyond the input buffer, potentially causing a crash or information disclosure when a user opens a specially crafted JPEG file. Red Hat has released an important security update addressing this issue in the gstreamer1-plugins-bad-free package for Red Hat Enterprise Linux 10.

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.