Операционные системы: уязвимости стека · Страница 128

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized dimensions, causing android_UpdateWindowFromSurface to copy heap memory beyond the allocation, leading to crashes or memory disclosure.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.24.04.1
• Обновитесь до 3.32.1+dfsg-0ubuntu0.26.04.1
• Обновитесь до 3.32.1+dfsg-1

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.

• Обновитесь до 3.32.1
• Обновитесь до 3.32.1+dfsg-1

Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).

• Обновитесь до 0.15.1-1

Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Updat

• Обновитесь до 0:1.26.1-1.module+el8.10.0+40244+e7cb3ff8

stgit-2.7.0-1.1 on GA media

These are all security issues fixed in the stgit-2.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 2.7.0-1.1

libspice-server-devel-0.16.0-3.1 on GA media

These are all security issues fixed in the libspice-server-devel-0.16.0-3.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 0.16.0-3.1

roundcubemail-1.6.20-1.1 on GA media

These are all security issues fixed in the roundcubemail-1.6.20-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 1.6.20-1.1

regclient-0.11.7-1.1 on GA media

These are all security issues fixed in the regclient-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 0.11.7-1.1

php8-8.5.12-1.1 on GA media

These are all security issues fixed in the php8-8.5.12-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 8.5.12-1.1

perl-Text-CSV_XS-1.650.0-1.1 on GA media

These are all security issues fixed in the perl-Text-CSV_XS-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 1.650.0-1.1

perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media

These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 4.800.0-1.1

owntone-29.3-1.1 on GA media

These are all security issues fixed in the owntone-29.3-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 29.3-1.1

libmodplug-devel-0.8.9.0+git20170610.f6dd59a-4.1 on GA media

These are all security issues fixed in the libmodplug-devel-0.8.9.0+git20170610.f6dd59a-4.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 0.8.9.0+git20170610.f6dd59a-4.1

kyverno-1.19.2-1.1 on GA media

These are all security issues fixed in the kyverno-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 1.19.2-1.1

ibus-typing-booster-2.31.2-1.1 on GA media

These are all security issues fixed in the ibus-typing-booster-2.31.2-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 2.31.2-1.1

go1.26-1.26.10-1.1 on GA media

These are all security issues fixed in the go1.26-1.26.10-1.1 package on the GA media of openSUSE Tumbleweed.

• Обновитесь до 1.26.10-1.1