Операционные системы: уязвимости стека · Страница 106

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation (CVE-2026-94603) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Обновитесь до 7:5.8.2-10.el10_2.alma.1

Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details abou

• Обновитесь до 5.1.1-19.el8_10

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more

• Обновитесь до 9.2.10-36.el8_10

Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fix(es): * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274) * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276) * libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275) * libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277) Bug Fix(es) and Enhancement(s): * [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275415) * [flute] Libr

• Обновитесь до 1:7.1.8.1-3.el8_10.alma.1

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

• Обновитесь до 5.14.0-687.60.1.el9_8

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

• Обновитесь до 12.68.0
• Обновитесь до 13.29.0
• Обновитесь до 13.31.0+dfsg-1

Laravel relationship inclusion can trigger unauthorized data destruction

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

• Обновитесь до 12.68.0
• Обновитесь до 13.27.0
• Обновитесь до 13.31.0+dfsg-1

Security update for go1.27

This update for go1.27 fixes the following issues: Update to go 1.27.3 (bsc#1272545): - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Обновитесь до 1.27.3-160000.1.1

Security update for go1.27

This update for go1.27 fixes the following issues: Update to go 1.27.3 (bsc#1272545): - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Обновитесь до 1.27.3-160000.1.1

Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.10 (bsc#1255111): - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772). - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Обновитесь до 1.26.10-160000.1.1

Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.10 (bsc#1255111): - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772). - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Обновитесь до 1.26.10-160000.1.1

CVE-2026-91403

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modificatio

• Обновитесь до 21.0.13+9-1
• Обновитесь до 21.0.13+9-1~deb13u2
• Обновитесь до 25.0.5+8-1
• Обновитесь до 25.0.5+8-1~deb13u1

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the c

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.

• Обновитесь до 13.0.0

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, com

• Обновитесь до 13.0.0

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame. Normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.

• Обновитесь до 13.0.0

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.

• Обновитесь до 13.0.0

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

• Обновитесь до 13.0.0

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in

• Обновитесь до 13.0.0

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

• Обновитесь до 13.0.0