Операционные системы: уязвимости стека · Страница 87

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) * kernel: inet: frags: strip GSO state from fragments before rea

• Обновитесь до 0:4.18.0-553.177.1.rt7.518.el8_10

Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), in

• Обновитесь до 0:5.1.1-19.el8_10

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s),

• Обновитесь до 0:9.2.10-36.el8_10

Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fix(es): * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274) * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276) * libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275) * libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277) Bug Fix(es) and Enhancement(s): * [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275415) * [flute] LibreOffice packa

• Обновитесь до 0:0.2.10-19.el8_10
• Обновитесь до 0:1.1.2-20.el8_10
• Обновитесь до 0:1.1.3-19.el8_10
• Обновитесь до 0:1.1.3-20.el8_10
• Обновитесь до 0:1.1.3-21.el8_10
• Обновитесь до 0:1.1.3-23.el8_10
• Обновитесь до 0:1.3.0-19.OOo31.el8_10
• Обновитесь до 1:0.9.4-17.el8_10
• Обновитесь до 1:7.1.8.1-3.el8_10

Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997) * openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998) * openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay (CVE-2026-60001) * openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000)

• Обновитесь до 0:8.0p1-34.el8_10

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) * kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590) * kernel: vfio/pci: clear vdev-

• Обновитесь до 0:4.18.0-553.177.1.el8_10

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

• Обновитесь до 1:39.0.0-6
• Обновитесь до 29.1.1
• Обновитесь до 32.1.1
• Обновитесь до 35.1.1
• Обновитесь до 39.0.1

CVE-2026-89419

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.

• Обновитесь до 1:39.0.0-6
• Обновитесь до 29.1.1
• Обновитесь до 32.1.1
• Обновитесь до 35.1.1
• Обновитесь до 39.0.1

CVE-2026-115638

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

UBUNTU-CVE-2026-85559

[Out-of-bounds read in Recursor findScopeZero]

• Обновитесь до 5.4.8-1

UBUNTU-CVE-2026-85558

[Recursor retains closed TCP client addresses until process exit]

• Обновитесь до 5.4.8-1

UBUNTU-CVE-2026-85557

[Single web client not doing TLS handshake monopolizes web access]

• Обновитесь до 5.4.8-1

UBUNTU-CVE-2026-85556

[Missing OPT RR owner-name validation bypasses ECS hardening]

• Обновитесь до 5.4.8-1

UBUNTU-CVE-2026-85555

[DNSSEC validation bypass and cache poisoning in PowerDNS Recursor via out-of-band NS resolution]

• Обновитесь до 5.4.8-1

UBUNTU-CVE-2026-77395

[Unknown description]

UBUNTU-CVE-2026-73206

[A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet]

• Обновитесь до 4.9.18-0+deb13u1
• Обновитесь до 5.1.5-1
• Обновитесь до 5.4.8-1

UBUNTU-CVE-2026-73205

[A malicious client can cause too many TCP connections in TIME_WAIT state]

• Обновитесь до 5.4.8-1