Операционные системы: уязвимости стека · Страница 114

Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

• Обновитесь до 0.11.6

uv before 0.11.15 Arbitrary File Write via Entry Point Names

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

• Обновитесь до 0.11.15

Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.

• Обновитесь до 1.2.8
• Обновитесь до 1.2.8-1

Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

• Обновитесь до 1.2.8
• Обновитесь до 1.2.8-1

Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

• Обновитесь до 1.2.8
• Обновитесь до 1.2.8-1

Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

• Обновитесь до 1.2.11-1
• Обновитесь до 1.2.9

Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

• Обновитесь до 1.2.9

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

• Обновитесь до 3.32.0
• Обновитесь до 3.32.0+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.0+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.0+dfsg-1

FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.

• Обновитесь до 3.32.0
• Обновитесь до 3.32.0+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.0+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.0+dfsg-1

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized dimensions, causing android_UpdateWindowFromSurface to copy heap memory beyond the allocation, leading to crashes or memory disclosure.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-1

Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).

• Обновитесь до 0.15.1-1

Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Updat

• Обновитесь до 0:1.26.1-1.module+el8.10.0+40244+e7cb3ff8

stgit-2.7.0-1.1 on GA media

These are all security issues fixed in the stgit-2.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 2.7.0-1.1

libspice-server-devel-0.16.0-3.1 on GA media

These are all security issues fixed in the libspice-server-devel-0.16.0-3.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 0.16.0-3.1

roundcubemail-1.6.20-1.1 on GA media

These are all security issues fixed in the roundcubemail-1.6.20-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 1.6.20-1.1