Операционные системы: уязвимости стека

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: drm/amd/display: set

• Обновитесь до 0:6.12.0-211.68.1.el10_2

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448) * kernel:

• Обновитесь до 0:5.14.0-687.60.1.el9_8

DEBIAN-CVE-2026-115936

DEBIAN-CVE-2026-115936

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794) * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D com

• Обновитесь до 0:140.17.0-1.el10_2

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-1

• Обновитесь до 0:140.17.0-1.el10_2

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794) * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D com

• Обновитесь до 0:140.17.0-1.el9_8

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-1

• Обновитесь до 0:140.17.0-1.el9_8

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-1

• Обновитесь до 0:140.17.0-1.el8_10

Critical: ca-certificates security update

The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI). Security Fix(es): * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Обновитесь до 0:2026.2.92_v9.0.319-81.3.el8_10

DEBIAN-CVE-2026-109411

DEBIAN-CVE-2026-109411

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incompl

• Обновитесь до 26.10.0rc1

Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transact

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.

• Обновитесь до 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.

• Обновитесь до 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

• Обновитесь до 26.10.0rc1

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.

• Обновитесь до 26.10.0rc1

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile. A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

• Обновитесь до 6.21.2