Операционные системы: уязвимости стека · Страница 98

Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Обновитесь до 0:1.7.3-1.module+el8.10.0+1596+477f03f8
• Обновитесь до 0:1.7.3-1.module+el8.10.0+1605+02e07af7
• Обновитесь до 0:1.7.3-1.module+el8.10.0+1911+f499711e
• Обновитесь до 0:2.0.3-1.module+el8.10.0+1596+477f03f8
• Обновитесь до 0:2.0.3-1.module+el8.10.0+1605+02e07af7
• Обновитесь до 0:2.0.3-1.module+el8.10.0+1911+f499711e
• Обновитесь до 0:3.2.2-2.module+el8.10.0+1911+f499711e
• Обновитесь до 0:5.1.23-1.module+el8.10.0+1596+477f03f8
• Обновитесь до 0:5.1.23-1.module+el8.10.0+1911+f499711e
• Обновитесь до 0:8.2.35-1.module+el8.10.0+40394+d21b33fb
• Обновитесь до 1:1.10.14-1.module+el8.10.0+1596+477f03f8
• Обновитесь до 1:1.10.14-1.module+el8.10.0+1911+f499711e

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.

• Обновитесь до 2.8.1-1

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619): - CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution. - CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege. - CVE-2024-43767: Heap overflow due to improper in

• Обновитесь до 2.54.1-150600.12.81.3
• Обновитесь до 2.54.1-150600.12.81.4

Security update for mutt

This update for mutt fixes the following issue: - CVE-2026-107570: heap out-of-bounds write in `convert_file_from_to()` via a crafted `Content-Type` header (bsc#1284739).

• Обновитесь до 2.2.14-150600.3.9.1

Security update for ca-certificates-mozilla

This update for ca-certificates-mozilla fixes the following issue: Updated to 2.92 state (bsc#1286261) Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1

• Обновитесь до 2.92-160000.1.1
• Обновитесь до 2.92-160000.1.4

webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing

• Обновитесь до 5.2.7
• Обновитесь до 6.1.0

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where pr

• Обновитесь до 5.2.7
• Обновитесь до 6.1.0

CVE-2026-106017

Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.

Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.225 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

• Обновитесь до 7-150400.2.1

Security update for podman

This update for podman rebuilds it against the current go security release.

• Обновитесь до 4.9.5-150500.3.84.1

Security update for php7

This update for php7 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981). - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216). - CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980). - CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875). - CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876). - CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877). - CVE-2026-91768: Access control byp

• Обновитесь до 7.4.33-150400.4.81.1
• Обновитесь до 7.4.33-150400.4.81.2

Security update for php8

This update for php8 fixes the following issue: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).

• Обновитесь до 8.0.30-150400.4.80.1
• Обновитесь до 8.0.30-150400.4.80.2

Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issues: Security issue fixed: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687). Non security issues fixed: - Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863). - Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498). - Make DIGEST-MD5 work with openssl3 (bsc#1230111).

• Обновитесь до 2.1.28-slfo.1.1_2.1

Mod_qos: query truncation during json body merging permits security-rule bypass

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.

Mod_qos: out-of-bounds reads in response-body substring matching

A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow

A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.

Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads

A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

• Обновитесь до 1.11.14-ee11
• Обновитесь до 3.0.16-ee17
• Обновитесь до 3.2.17
• Обновитесь до 3.2.17-ee1
• Обновитесь до 3.2.26
• Обновитесь до 3.2.26-1
• Обновитесь до 3.3.17
• Обновитесь до 3.4.6
• Обновитесь до 3.5-dev9