Операционные системы: уязвимости стека · Страница 169

virtualenv: Venv configuration readback can reinterpret path boundaries

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attac

• Обновитесь до 21.14.9

virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during envi

• Обновитесь до 21.14.9

virtualenv: Xonsh activation literals depend on the script decoding codec

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.

• Обновитесь до 21.14.9

virtualenv: Pip seeding with download omits wheel digest verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstr

• Обновитесь до 21.14.9

virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. The --clear option removes the planted tree first, while ordinary creation reaches it; arbitrary attacker-selected output bytes are not established. This

• Обновитесь до 21.14.9

Use-after-free in S/MIME decryption during a security device password prompt

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.

Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

• Обновитесь до 1:153.5.1esr-1~deb12u1
• Обновитесь до 1:153.5.1esr-1~deb13u1

Stanza injection in XMPP chat

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

• Обновитесь до 1:153.5.1esr-1~deb12u1
• Обновитесь до 1:153.5.1esr-1~deb13u1

Account password sent unencrypted during Exchange account setup

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

• Обновитесь до 1:153.5.1esr-1~deb12u1
• Обновитесь до 1:153.5.1esr-1~deb13u1

virtualenv: Downloaded wheel selection and caching precede verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without v

• Обновитесь до 21.14.9

virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.

• Обновитесь до 21.14.10

Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues: The following security issues were fixed: - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

• Обновитесь до 4-2.1

Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576). - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-

• Обновитесь до 1.35.0-10.12.1

follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in re

• Обновитесь до 1.16.1
• Обновитесь до 1.16.1+~1.14.4-1

Security update for bind

This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433). - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435). - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436). - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildc

• Обновитесь до 9.16.50-150500.8.46.1

xz-utils vulnerability

It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.

• Обновитесь до 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3
• Обновитесь до 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3
• Обновитесь до 5.2.2-1.3ubuntu0.1+esm2
• Обновитесь до 5.2.4-1ubuntu1.1+esm2
• Обновитесь до 5.2.5-2ubuntu1.2
• Обновитесь до 5.6.1+really5.4.5-1ubuntu0.4
• Обновитесь до 5.8.3-1ubuntu0.1
• Обновитесь до 5.8.3-1ubuntu1

ca-certificates update

This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.

• Обновитесь до 20260816ubuntu0.22.04.1
• Обновитесь до 20260816ubuntu0.24.04.1
• Обновитесь до 20260816ubuntu0.26.04.1
• Обновитесь до 20260816ubuntu0.26.10.1

Security update for yt-dlp

This update for yt-dlp fixes the following issues: Changes in yt-dlp: Update to version 2026.08.19: * utils: float_or_none: Catch OverflowError * americastestkitchen: Fix season/series extraction * apple: Rework extractors * ard: Remove dead extractor * bandcamp: Support browser impersonation * bfmtv: Fix extractor * instagram: Fix logged-in extraction * showroom: Rework extractors * tiktok: Fix extractor * tiktok: Fix formats extraction * tiktok: Support share URLs * twitter: broadcast: Fix events handling * vimeo: Remove ios and macos clients * whyp: Fix extractor * youtube: Add visionos player client * yo

• Обновитесь до 2026.08.19-bp160.1.1

Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Обновитесь до 3.5.3

Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Обновитесь до 3.5.3