Threats Tagged 'ubuntu-26-10'

CVE-2026-89088 is a heap-based buffer overflow vulnerability in libparted's file system resizing logic for FAT16 volumes on Red Hat Enterprise Linux 10. It occurs when resizing a specially crafted FAT16 file system image with malformed directory metadata, leading to memory corruption and application crash, causing denial of service. The vulnerability requires user interaction and local access to trigger.

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

A critical vulnerability (CVE-2026-92262) exists in MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. The issue involves the #mysql50# bypass prefix, which allows bypassing normal table-name filesystem encoding. An attacker can exploit this to cause crashes, data corruption, data exfiltration, or remote code execution. The vulnerability has a CVSS score of 9.9 and is fixed in the stated versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVE-2026-61702 is a path traversal vulnerability in OpenPrinting CUPS prior to version 2.4.20. It allows an attacker to use crafted IPP attributes to escape the intended banner directory and cause the scheduler to read arbitrary files accessible via symlinks. The contents of these files can then be copied into a job-sheet spool object and potentially exposed to an attacker-observable endpoint. This vulnerability is fixed in version 2.4.20.

CVE-2026-55480 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 involving improper link resolution before file access. The copy_model() function creates a predictable temporary file path in a directory writable by the lp group and opens it as root without safe flags to prevent symlink attacks. An attacker with lp group write access can plant a symbolic link to a root-writable file, which the root process then overwrites, compromising file integrity or availability. This requires a race condition and elevated privileges to trigger the vulnerable operation. The issue is fixed in version 2.4.20.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

OpenVPN versions 2.7_alpha1 through 2.7.7 contain a vulnerability that allows remote authenticated users to impersonate other users by exploiting a crafted certificate subject field. This issue affects multiple specific OpenVPN package versions primarily on Ubuntu distributions. The vulnerability is rated medium severity based on the CVSS 4.0 vector provided. There is no explicit patch or remediation information available in the provided data.

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables. As a result, an unauthenticated remote attacker can supply a crafted Remote-User request header which is exposed to the application as HTTP_REMOTE_USER. When HTTP Basic Authentication is configured as the authentication backend, OTRS trusts this value as an already authenticated username and does not perform an additional password verification. An attacker may therefore authenticate through the Generic Interface as an existing agent or customer user without knowing the corresponding credentials. The resulting privileges depend on the account being impersonated. Successful exploitation may allow access to confidential information and modification of data or configuration with the permissions of the affected user. Exploitation requires HTTP Basic Authentication to be configured as an authentication backend and a web server environment in which attacker-controlled HTTP headers are exposed through the corresponding HTTP_* environment variables. OTRS 7 and later are not affected by this attack vector due to the use of Mojolicious/Hypnotoad and does not expose arbitrary request headers through %ENV in the manner required for exploitation. The supported REMOTE_USER mechanism additionally requires validation through the configured SSO shared secret. The unused HTTP_REMOTE_USER fallback has nevertheless been removed as a security-hardening measure. Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email. When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected