an-website (>=22.5.13, <=22.5.18), dsp-tools (1.15.0) +5 more potentially affected by CVE-2026-59890 via setuptools (62.2.0)

setuptools PYPI version 62.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.5.13, =0.0.7, =0.3.8, =0.0.1, =0.0.16 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

dicgram (>=2.0.9, <=2.1.1), dsp-metadata-gui (>=1.3.2, <=8.5.0) +1 more potentially affected by CVE-2026-59890 via setuptools (67.3.1)

setuptools PYPI version 67.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - dicgram =2.0.9, =1.3.2, =8.5.0 - renku-lock 2.3.0 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

Oracle Linux 10 : freerdp (ELSA-2026-36203)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36203 advisory. - Backport several CVE fixes CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700 Resolves: RHEL-186978, RHEL-186967,...

an-website (>=22.5.13, <=22.5.18), dsp-tools (1.15.0) +5 more potentially affected by CVE-2026-59890 via setuptools (62.2.0)

setuptools PYPI version 62.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.5.13, =0.0.7, =0.3.8, =0.0.1, =0.0.16 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

dsp-tools (1.17.1), elementary-flask (>=0.0.1.dev13, <=0.0.1.dev17) +3 more potentially affected by CVE-2026-59890 via setuptools (65.2.0)

setuptools PYPI version 65.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - dsp-tools 1.17.1 - elementary-flask =0.0.1.dev13, =0.1.0, =2.2.6, =2.2.8 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

an-website (>=22.7.23, <=22.8.3), aws-toolbox (0.0.2) +10 more potentially affected by CVE-2026-59890 via setuptools (63.2.0)

setuptools PYPI version 63.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.7.23, =4.0.0, =1.0.6, =1.0.1, =0.13.0, =0.0.3, =0.0.4 - vpc-img-inst 1.0.0b7 Source cves: CVE-2026-59890 Source advisory:...

an-website (>=22.7.23, <=22.8.3), aws-toolbox (0.0.2) +10 more potentially affected by CVE-2024-6345 via setuptools (63.2.0)

setuptools PYPI version 63.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.7.23, =4.0.0, =1.0.6, =1.0.1, =0.13.0, =0.0.3, =0.0.4 - vpc-img-inst 1.0.0b7 Source cves: CVE-2024-6345 Source advisory:...

dicgram (>=2.0.9, <=2.1.1), dsp-metadata-gui (>=1.3.2, <=8.5.0) +1 more potentially affected by CVE-2024-6345 via setuptools (67.3.1)

setuptools PYPI version 67.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - dicgram =2.0.9, =1.3.2, =8.5.0 - renku-lock 2.3.0 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

CVE-2026-25271 Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use...

CVE-2026-45258

dspmmapsingle validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to ...

EUVD-2026-39962

dspmmapsingle validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to ...

CVE-2026-45258

The FreeBSD sound(4) driver contains a memory-safety vulnerability in the dsp_mmap_single() function. A lack of proper overflow checking when summing user-supplied offset and length values allows these values to wrap around, passing validation. Subsequently, narrowing the offset from 64 to 32 bit...

CVE-2026-45258

dspmmapsingle validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to ...

CVE-2026-49417

The FreeBSD sound(4) driver contains a memory-safety error in its mmap(2) support. Specifically, the audio buffer backing a mapping can be freed when the device is closed while the mapping remains valid. This allows the freed memory to be reused elsewhere while still accessible through the stale ...

CVE-2026-49417

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system wit...

CVE-2026-49417: Use After Free

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system wit...

CVE-2026-45258: Out-of-bounds Read

dspmmapsingle validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to ...

SUSE CVE-2026-53158

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpcrpmsgprobe has completed initialization: Unable to handle kern...

freerdp security update

2:2.11.7-7.3 - Lock appWindow to fix use-after-free in RAIL mode CVE-2026-25952 Resolves: RHEL-159860 2:2.11.7-7.2 - Fix double free in xfrailwindowcommon cleanup CVE-2026-26986 - Fix growth of preallocated buffers CVE-2026-27951 - Fix heap-buffer-overflow in bitmapcacheput CVE-2026-29775 - Add D...

CVE-2026-53161

The CVE-2026-53161 entry concerns a use-after-free in the Linux kernel fastrpc subsystem. A race between fastrpc_device_release() (on file close) and the workqueue processing DSP responses can free the fastrpc_user while an in-flight DSP invocation is completing, leading to dereferencing freed co...