Операционные системы: уязвимости стека · Страница 96

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.

• Обновитесь до 4.0.9

Pre-boot RCE in EDK II PXE driver

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

dnspython dns.name.from_wire_parser() excessive CPU use

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

• Обновитесь до 2.9.0

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can

• Обновитесь до 3.2.12
• Обновитесь до 3.2.12-1
• Обновитесь до 3.3.0rc1

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

• Обновитесь до 3.2.12
• Обновитесь до 3.2.12-1
• Обновитесь до 3.3.0rc1

Security update for php74

This update for php74 fixes the following issues: Fixed two security issues: - CVE-2026-109618: memory corruption leading to RCE - CVE-2026-109619: memory corruption leading to RCE

• Обновитесь до 7.4.33-1.74.1

Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335). Changes for cpupower: - intel-speed-select: Harden daemon pidfile open (git-fixes, bsc#1278335, CVE-2026-80663) - turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes) - cpupower: Reset errno before strtoull() (stable-fixes) - intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes) - cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes) - cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes) - cpufreq: Fix a bug where the -

• Обновитесь до 6.12.0-160000.3.1

Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335). Changes for cpupower: - intel-speed-select: Harden daemon pidfile open (git-fixes, bsc#1278335, CVE-2026-80663) - turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes) - cpupower: Reset errno before strtoull() (stable-fixes) - intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes) - cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes) - cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes) - cpufreq: Fix a bug where the -

• Обновитесь до 6.12.0-160000.3.1

Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335). Changes for cpupower: - intel-speed-select: Harden daemon pidfile open (git-fixes, bsc#1278335, CVE-2026-80663) - turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes) - cpupower: Reset errno before strtoull() (stable-fixes) - intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes) - cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes) - cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes) - cpufreq: Fix a bug where the -

• Обновитесь до 6.12.0-160000.3.1

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or

• Обновитесь до 1.45.1
• Обновитесь до 1.45.1-1

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: - CVE-2026-64718: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (bsc#1277001). - CVE-2026-65335: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (bsc#1277015). - CVE-2026-78376: use-after-free of `JSCValue` function parameters (bsc#1276418). - CVE-2026-83596: webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (bsc#1277755). Non security issue fixed: - libjavascriptcoregtk-4_0-18: JSGlobalContextCreate() aborts on aarch64 64 KB-pag

• Обновитесь до 2.54.1-150400.4.157.4
• Обновитесь до 2.54.1-150400.4.157.5

Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.10 (bsc#1255111, jsc#SLE-18320): - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766). - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767). - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768). - CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769). - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78667: net/http:

• Обновитесь до 1.26.10-150000.1.21.2

Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.10 (bsc#1255111, jsc#SLE-18320): - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766). - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767). - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768). - CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769). - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78667: net/http:

• Обновитесь до 1.26.10-150600.13.18.1

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates th

• Обновитесь до 1.20.9
• Обновитесь до 2.4.0
• Обновитесь до 2.4.0+~1.19.6-1

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storag

• Обновитесь до 2.5.0

ALPINE-CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

• Обновитесь до 1.1.1-r0
• Обновитесь до 1.2.1-r0

Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.10 (bsc#1255111): - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772). - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Обновитесь до 1.26.10-150000.1.36.1

Security update for go1.27

This update for go1.27 fixes the following issues: Update to go 1.27.3 (bsc#1272545): - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Обновитесь до 1.27.3-150000.1.15.1

Out-of-Bounds Write in Google Brotli Decoder

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

• Обновитесь до 1.0.10
• Обновитесь до 1.0.3-1ubuntu1.3+esm1
• Обновитесь до 1.0.3-1ubuntu1~16.04.2+esm1
• Обновитесь до 1.0.7-6ubuntu0.1+esm1
• Обновитесь до 1.0.9-2+deb12u1
• Обновитесь до 1.0.9-2ubuntu0.1
• Обновитесь до 1.1.0-2+deb13u1
• Обновитесь до 1.1.0-2ubuntu0.1
• Обновитесь до 1.1.1
• Обновитесь до 1.2.0-4ubuntu0.1
• Обновитесь до 1.2.1
• Обновитесь до 1.2.1.0
• Обновитесь до 1.2.1.0+ds-1
• Обновитесь до 10.0.114-10.0.14-0ubuntu1~24.04.1
• Обновитесь до 8.0.133-8.0.33-0ubuntu1~22.04.1
• Обновитесь до 8.0.133-8.0.33-0ubuntu1~24.04.1

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path c