Threat database

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

This is a security update for the jackson-core component provided by SUSE Product Security Team. It is functionally equivalent to the Red Hat advisory RHSA-2026:86706. No specific affected versions or detailed vulnerability information is provided in the input data. The severity is assessed as medium.

A vulnerability in m17n-lib can cause a denial of service due to a null pointer dereference during library initialization failure. This occurs under specific error conditions like resource exhaustion or database corruption when an application opens an input method. The flaw affects multiple specific versions of m17n-lib and results in application crashes without impacting confidentiality or integrity.

Red Hat has issued a security advisory for its Hardened Images RPMs, specifically updating multiple Rust-related packages to address three security vulnerabilities identified as CVE-2026-109349, CVE-2026-109350, and CVE-2026-109351. The update includes various Rust components such as cargo, clippy, rust-analyzer, rustfmt, and several rust-std-static packages across multiple architectures. No specific affected versions are detailed, and no explicit fix version is provided. The advisory is classified as medium severity.

A stack-based buffer overflow vulnerability exists in fetchmail when it is built with NTLM support. This flaw can be exploited by a malicious or compromised mail server sending a crafted NTLM Type 2 challenge, potentially causing fetchmail to overwrite a fixed stack buffer. The vulnerability may lead to remote code execution, authentication failures, or process termination under memory hardening conditions. Multiple specific fetchmail versions across SUSE and Ubuntu distributions are affected. The vulnerability is classified as medium severity with a CVSS score of 8.1.

A denial of service vulnerability exists in the perl-DBI package for Red Hat Enterprise Linux 8 due to an invalid memory read during numeric type casting. This issue affects multiple architectures including x86_64, ppc64le, and aarch64. Red Hat has rated this vulnerability as important and has released updated perl-DBI packages to address it.

This entry references a security update for SUSE related to dotnet10.0, providing a functional equivalent of Red Hat advisory RHSA-2026:86193. The update addresses multiple CVEs listed in the tags but does not specify affected versions or detailed vulnerability descriptions. The severity is marked as critical, but no CVSS score or detailed technical information is provided.

Multiple security vulnerabilities were identified in OpenSSL and OpenSSL 1.0 on various Ubuntu LTS releases, including issues causing denial of service, heap buffer overflow, and potential arbitrary code execution. These vulnerabilities affect OpenSSL's handling of CMS key unwrapping, QUIC protocol processing, TLS handshake buffering, and other cryptographic operations. Fixes are available through official Ubuntu security updates.

This security update provides a functional equivalent of RHSA-2026:86033. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:86033.

A security vulnerability (CVE-2026-87766) affects bubblewrap, a core execution engine for unprivileged containers used as a setuid binary on kernels without user namespaces. The flaw involves a symlink traversal via /oldroot that allows writing files outside the intended sandbox during setup. Red Hat has issued an important security update for bubblewrap in Red Hat Enterprise Linux 9.6 Extended Update Support and related variants to address this issue.

This is a security update for Wireshark provided by the SUSE Product Security Team, corresponding functionally to Red Hat advisory RHSA-2026:83546. The update addresses multiple vulnerabilities identified by CVE identifiers including CVE-2026-76880 and others. No specific affected versions or detailed technical vulnerability descriptions are provided in the available data. The update is classified as high severity but lacks a CVSS score. No known exploits in the wild are reported at this time.

A vulnerability in Ghostscript allows crafted PostScript or EPS documents to bypass the -dSAFER sandbox and execute arbitrary shell commands. This occurs through a combination of memory corruption during document parsing and disabling of internal path access controls at runtime. Exploitation can compromise confidentiality, integrity, and availability of data accessible to the Ghostscript process. The affected versions include 10.05.0dfsg1-0ubuntu4 and 10.05.0dfsg1-0ubuntu5. The vulnerability has a CVSS score of 7.8, indicating a high impact. No known exploits are reported in the wild, and no patch or remediation details are provided in the input data.

Multiple heap buffer overflow vulnerabilities have been identified in libsoup3, an HTTP library used in GNOME applications for asynchronous HTTP communication. These vulnerabilities affect various aspects of data processing, including base64 decoding of data-URIs, WebSocket message handling, and buffer growth during WebSocket operations. Red Hat has issued security updates addressing these issues in Red Hat Enterprise Linux 10 and related products.

A security update for rpcbind addresses CVE-2026-94640, which involves unbounded memory allocation in statistics tracking. This vulnerability allows unauthenticated remote denial of service attacks. The issue affects multiple specific versions of rpcbind as used in SUSE and Ubuntu distributions. The severity is rated high. No known exploits in the wild have been reported. The update fixes this vulnerability.

This update for mariadb-connector-c fixes the following issue: - CVE-2026-44172: mysql_real_escape_string() incorrectly handled big5 (bsc#1266438). Changes for mariadb-connector-c: - Update to release 3.4.9. - Update to release 3.4.8: * Fix compilation with GCC 15 * CONC-762: always set is_null and length in the bind structure to avoid msan errors * CONC-763: add MySQL collation ID 309 (utf8mb4_0900_bin) * CONC-764: fix build of ma_context.c on Android (X18 is a platform-reserved register) * CONC-766: disable clang -Wcast-function-type-strict for makecontext

Red Hat has released a security advisory for Red Hat Hardened Images RPMs addressing a vulnerability identified as CVE-2026-103111. The issue is related to the pcre2 packages and is categorized under CWE-787, indicating a potential out-of-bounds write vulnerability. The advisory does not provide detailed technical information or specify affected versions. No known exploits are reported in the wild. An update to version 10.49-0.1.hum1 of multiple pcre2-related RPMs is available and should be applied to mitigate the vulnerability.

This security update for HPLIP addresses multiple critical vulnerabilities including privilege escalation and arbitrary code execution via an integer overflow and OS command injection. The update also includes support for numerous new HP printers, fixes for configuration parsing errors, compiler warnings, and package restructuring. The vulnerabilities fixed are identified as CVE-2026-8631 and CVE-2026-8632, with an additional fix for CVE-2025-43023 related to GPG key support. The update refactors the package structure and drops outdated driver support to improve security and maintainability.

This security advisory addresses multiple vulnerabilities in Mozilla Thunderbird distributed by Red Hat and SUSE. The issues include use-after-free, out-of-bounds access, and improper access control among others. A patch is available to remediate these vulnerabilities affecting various versions prior to specified releases. The vulnerabilities are considered high severity.

This security update provides a functional equivalent of RHSA-2026:83207. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:83207.