[SECURITY] [DLA 4856-1] xdg-dbus-proxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4856-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley October 23, 2026 https://wiki.debian.org/LTS -...

Important: xorg-x11-server-Xwayland

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: tigervnc

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: xorg-x11-server

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: perl-YAML

Issue Overview: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY do...

Important: pcre2

Issue Overview: A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code...

Important: xorg-x11-server

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: tigervnc

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88229)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688229 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer...

Rocky Linux 10.2 [CIQ] Security Update: postgresql18-pgvector / postgresql18-pgvector-debuginfo / etc (crlsa-2026_88360)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202688360 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Security update for docker (important)

openSUSE security update: security update for docker ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22158-1 Rating: important References: bsc1073877 bsc1099277 bsc1262346 bsc1265782 bsc1266176 bsc1266625 bsc1267827 bsc1268280 bsc1268359 bsc1271209...

PHP 8.5.12 Session Upload Progress Serializer Confusion

PHP version 8.5.12 contains a session upload progress serializer confusion issue when an application changes the session serializer at runtime, allowing unauthenticated object injection and remote code execution where a suitable gadget is present. https://packetstorm.news/download/237404...

Linux Distros Unpatched Vulnerability : CVE-2026-110264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3...

AlmaLinux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792819460)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792819460 advisory. - xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow CVE-2026-93517 -...

MiracleLinux 8 : xorg-x11-server-Xwayland-21.1.3-20.el8_10.4 (AXSA:2026-2137:09)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2137:09 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server:...

Amazon Linux 2 : perl-YAML (ALAS-2026-4035)

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4035 advisory. YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A...

Debian dla-4856 : xdg-dbus-proxy - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4856 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4856-1 [email protected] https://www.debian.org/lts/security/...

Rocky Linux 10.2 [CIQ] Security Update: pgvector / pgvector-debuginfo / postgresql16-pgvector-debugsource (crlsa-2026_88359)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202688359 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Rocky Linux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792819460)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792819460 advisory. - xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow CVE-2026-93517 -...

Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2026_88164)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...