5514 matches found
python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
A flaw was found in Python's decompression modules, including lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is...
ALSA-2026:52675 Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
ALSA-2026:52674 Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
RHEL 10 : libarchive (RHSA-2026:52675)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52675 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM...
RHEL 9 : libarchive (RHSA-2026:52674)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52674 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM...
MiracleLinux 9 : pacemaker-2.1.10-3.el9_8 (AXSA:2026-1502:03)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1502:03 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description...
RHEL 7 : python3 (RHSA-2026:52400)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52400 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...
fwupd:uswid_fuzzer: Crash in g_byte_array_append
Project: https://github.com/fwupd/fwupd.git Detailed Report: https://oss-fuzz.com/testcase?key=5430594256044032 Project: fwupd Fuzzing Engine: libFuzzer Fuzz Target: uswidfuzzer Job Type: libfuzzerasanfwupd Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7a619a501520 Crash State:...
EulerOS 2.0 SP11 : libarchive (EulerOS-SA-2026-3129)
According to the versions of the libarchive packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of...
SUSE CVE-2026-70635
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...
JLSEC-2026-1184 FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
...
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
...
EUVD-2026-54183
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...
SUSE CVE-2026-19027
The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...
PT-2026-81462
Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.1.0 through 3.2.10 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description On ILP32 builds, an out-of-bounds write occurs when processing a crafted B44-compressed scanline EXR. This happens...
PT-2026-81478
Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.2.0 through 3.2.10 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description On ILP32 builds, a heap out-of-bounds read occurs when processing a crafted RLE-compressed EXR image. The issue arise...
CVE-2026-70635
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...
CVE-2026-70631 FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates...