Операционные системы: уязвимости стека · Страница 110

bpf: Infer zext_dst based on static register liveness analysis

In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zext_dst based on static register liveness analysis As reported in the thread [1], the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on s390 architecture. According to BPF semantics, operation `w1 += 1` is supposed to zero extend the upper half of the register `r1`. On s390 the JIT relies on the verifier emitting explicit zero extension before such operations. The verifier attempts to minimize the amount of zero extensions inserted by tracking whether upper halves of the 64-bit

pypdf: Unvalidated JPEG image data loading

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

• Обновитесь до 6.21.1
• Обновитесь до 6.21.1-1

Security update for buildah

This update for buildah rebuilds it against the current go security release.

• Обновитесь до 1.35.5-150500.3.68.1

RCE via stale global state

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

• Обновитесь до 5.5.9+dfsg-1ubuntu4.29+esm18
• Обновитесь до 7.0.33-0ubuntu0.16.04.16+esm22
• Обновитесь до 7.2.24-0ubuntu0.18.04.17+esm14
• Обновитесь до 7.4.3-4ubuntu2.29+esm5
• Обновитесь до 8.1.2-1ubuntu2.28
• Обновитесь до 8.2.35
• Обновитесь до 8.2.35-1~deb12u1
• Обновитесь до 8.3.36
• Обновитесь до 8.3.6-0ubuntu0.24.04.13
• Обновитесь до 8.4.27
• Обновитесь до 8.4.27-1
• Обновитесь до 8.4.27-1~deb13u1
• Обновитесь до 8.5.12
• Обновитесь до 8.5.4-0ubuntu1.5
• Обновитесь до 8.5.9-0ubuntu2.1

Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

• Обновитесь до 5.4.0

RCE via OOM corruption

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

• Обновитесь до 5.5.9+dfsg-1ubuntu4.29+esm18
• Обновитесь до 7.0.33-0ubuntu0.16.04.16+esm22
• Обновитесь до 7.2.24-0ubuntu0.18.04.17+esm14
• Обновитесь до 7.4.3-4ubuntu2.29+esm5
• Обновитесь до 8.1.2-1ubuntu2.28
• Обновитесь до 8.2.35
• Обновитесь до 8.2.35-1~deb12u1
• Обновитесь до 8.3.36
• Обновитесь до 8.3.6-0ubuntu0.24.04.13
• Обновитесь до 8.4.27
• Обновитесь до 8.4.27-1
• Обновитесь до 8.4.27-1~deb13u1
• Обновитесь до 8.5.12
• Обновитесь до 8.5.4-0ubuntu1.5
• Обновитесь до 8.5.9-0ubuntu2.1

ALPINE-CVE-2026-97313

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 9.20.30-r0

ALPINE-CVE-2026-96888

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 9.20.30-r0

ALPINE-CVE-2026-94300

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 9.20.30-r0

ALPINE-CVE-2026-19630

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 9.20.30-r0

Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687).

• Обновитесь до 2.1.28-150600.7.17.1

Security update for xwayland

This update for xwayland fixes the following issues: - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213). - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218). - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220). - CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225). - CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227). - CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233). - CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236). - CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer O

• Обновитесь до 24.1.5-150700.3.25.1

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493): - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component. - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component. - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component. - CVE-2026-109709: Information disclosure

• Обновитесь до 153.5.0-150400.157.16.1

Security update for python-hpack

This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime (bsc#1283035).

• Обновитесь до 4.0.0-150400.8.6.1

Specific RPZ configurations and query patterns may result in an unexpected exit

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 1:9.18.39-0ubuntu0.22.04.8
• Обновитесь до 1:9.18.39-0ubuntu0.24.04.9
• Обновитесь до 1:9.20.24-1ubuntu0.5
• Обновитесь до 1:9.20.24-1ubuntu3.1
• Обновитесь до 1:9.20.30-1
• Обновитесь до 1:9.20.30-1~deb13u1

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 1:9.18.39-0ubuntu0.22.04.8
• Обновитесь до 1:9.18.39-0ubuntu0.24.04.9
• Обновитесь до 1:9.20.24-1ubuntu0.5
• Обновитесь до 1:9.20.24-1ubuntu3.1
• Обновитесь до 1:9.20.30-1
• Обновитесь до 1:9.20.30-1~deb13u1

Concurrent GSS-TSIG messages corrupt memory

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 1:9.18.39-0ubuntu0.22.04.8
• Обновитесь до 1:9.18.39-0ubuntu0.24.04.9
• Обновитесь до 1:9.20.24-1ubuntu0.5
• Обновитесь до 1:9.20.24-1ubuntu3.1
• Обновитесь до 1:9.20.30-1
• Обновитесь до 1:9.20.30-1~deb13u1

Amplified resource exhaustion in inbound message processing

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

• Обновитесь до 1:9.18.39-0ubuntu0.22.04.8
• Обновитесь до 1:9.18.39-0ubuntu0.24.04.9
• Обновитесь до 1:9.20.24-1ubuntu0.5
• Обновитесь до 1:9.20.24-1ubuntu3.1
• Обновитесь до 1:9.20.30-1
• Обновитесь до 1:9.20.30-1~deb13u1

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531). - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267). - CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851). - CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694). - CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730). - CVE-2026-53108: powerpc/64s: Fix unmap race

• Обновитесь до 6.4.0-159998.54.1
• Обновитесь до 6.4.0-159998.54.1.159998.21.40

Important: bubblewrap security update

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Обновитесь до 0:0.10.0-5.el10_2