[SECURITY] [DSA 6543-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6543-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...

CVE-2026-93320

BuildKit is vulnerable to a flaw where it may be tricked into performing file actions using special file inodes instead of the expected regular files. This behavior can lead to blocked operations or, in environments with rootful workers , potentially allow unintended host device access . No speci...

CVE-2026-93320 BuildKit improperly handles special files in build snapshots

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

CVE-2026-93320 BuildKit improperly handles special files in build snapshots

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

CVE-2026-86671

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Migration Plugin DB & Files – WP Synchro versions = 1.16.1...

Path Traversal

Apache Jena Fuseki is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of file paths, where the server fails to properly restrict directory traversal in request handling and attackers can craft malicious ../ sequences to read arbitrary files on the system...

BIT-PYTHON-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick, specifically in the code file coders/hdr.c. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, resulting in values that are outside the range of the type unsigned char. This likely leads to a disruption in the...

Astra Linux – Vulnerability in Linux, Linux 5.10

The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling ‘file’ pointer...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring: fixed the memory leak related to the uid during file registration. When there are no files for iosqefilesscm to process within a certain range, it will free all resources and return. However, it forgot to set the uid...

Astra Linux – Vulnerability in gst-plugins-bad1.0

GStreamer MXF File Parsing: Integer Overflow and Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may va...

Astra Linux – Vulnerability in openimageio

There are multiple denial-of-service vulnerabilities in the image output closing functionality of the OpenImageIO Project’s OpenImageIO v2.4.4.2. specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious inputs to exploit these...

Astra Linux – Vulnerability in liblivemedia

Live555 version 1.08 has a memory leak in the AC3AudioStreamParser for AC3 files...

Astra Linux – Vulnerability in emacs

In Emacs versions before 29.3, the Org mode considers the contents of remote files to be trustworthy. This affects Org Mode in versions prior to 9.6.23...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: Defer the garbage collection of registered files to iouring’s responsibility. Instead of having unixgc handle the registered files of iouring, we want iouring to handle them itself. The key here is to consider the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the context of dm-verity-target.c, there is a potential way to modify read-only files due to a missing permission check. This could lead to a local escalation of privileges, as System execution privileges are required. User interaction is not necessary for exploiting this vulnerability. Produc...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection through crafted archives or compressed files...

Astra Linux – Vulnerability in grub2

The GRUB2’s shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules being loaded in GRUB2, thereby breaking the secure boot trust-chain...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH 8.2, the scp client incorrectly sends duplicate responses to the server when a utimes system call fails. This allows a malicious, unprivileged user on the remote server to overwrite arbitrary files in the client’s download directory by creating a crafted subdirectory anywhere on the...