Операционные системы: уязвимости стека · Страница 170

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.

• Обновитесь до 3.0.20.0
• Обновитесь до 3.1.15.0
• Обновитесь до 3.2.0.3-beta1

HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.

HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.

Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Обновитесь до 3.5.3

Apache CouchDB: Replicator follows redirects indefinitely

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Обновитесь до 3.5.3

Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Обновитесь до 3.5.3

Apache CouchDB: Admin credentials leading to code execution as operating system user

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

• Обновитесь до 3.5.3

Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.163 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

• Обновитесь до 9-150500.2.1

Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042). - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679). Changes for amazon-ecs-init: - Update to version 1.108.0 * Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161) * Enhancement - Remove direct docker run instructions fro

• Обновитесь до 1.108.0-160000.1.1

Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579). - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).

• Обновитесь до 5.4.2-slfo.1.1_6.1

Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060). - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061). - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064). - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065). - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066). - CVE-2026-102270: an attac

• Обновитесь до 2.12.1-slfo.1.1_3.1

Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042). - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679). Changes for amazon-ecs-init: - Update to version 1.108.0 * Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161) * Enhancement - Remove direct docker run instructions fro

• Обновитесь до 1.108.0-160000.1.1

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.

• Обновитесь до 1.1.0
• Обновитесь до 8.2.4
• Обновитесь до 8.3.3

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by

• Обновитесь до 1.1.0
• Обновитесь до 6.4.4
• Обновитесь до 7.3.7
• Обновитесь до 8.1.6
• Обновитесь до 8.2.4
• Обновитесь до 8.3.3

Vite: Cross origin script execution through Vite custom middleware

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execut

• Обновитесь до 1.1.0
• Обновитесь до 6.4.4
• Обновитесь до 7.3.7
• Обновитесь до 8.1.6
• Обновитесь до 8.2.4
• Обновитесь до 8.3.3

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privi

• Обновитесь до 1.16.6-1~deb13u3
• Обновитесь до 1.18.1-1