openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:21574-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21574-1 advisory. This update for amazon-ecs-init fixes the following issue: Update to version 1.106.0. Security issues fixed: - CVE-2026-10722: github.com/cilium/ebpf:...

OPENSUSE-SU-2026:21574-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue: Update to version 1.106.0. Security issues fixed: - CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed bsc1267794. Other...

CVE-2026-12235

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

EUVD-2026-57070

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235

The CVE describes an out-of-bounds write in the Xtensa llext PLT relocation path. Specifically, during relocation in llext_link_plt(), the patch address is computed using rela.r_offset without validating it, allowing a crafted RELA entry with a large r_offset to write outside the extension’s text...

MAL-2026-13736 Malicious code in @nzeros/codebreak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe The package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-- as its compiled output. The darwin-arm6...

CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68151 binfmt_elf_fdpic: only honour the first PT_INTERP

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

EUVD-2026-55537

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68151

The CVE-2026-68151 entry concerns the Linux kernel FDPIC ELF binary format driver (binfmt_elf_fdpic). The flaw arises in how the program header scan handles PT_INTERP: the code may break out of the inner switch rather than the outer loop, causing binaries with more than one PT_INTERP to overwrite...

MAL-2026-13628 Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

MAL-2026-13519 Malicious code in streak-kit-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...

MAL-2026-13459 Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...

Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

Malicious code in streak-grid-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7 The package advertises itself as dependency-free calendar/streak math primitives, but the main entry index.mjs, resolved via package.json exports "."...

MAL-2026-12471 Malicious code in streak-view-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2...

MAL-2026-12467 Malicious code in streak-int-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35 [email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data defaultConfig.data joined into embeddedService in...

Malicious code in streak-metricsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a707525e88d0f5d3004f833b17a7544655da43715d9d7af3e6d635ff3a6801a9 [email protected] presents itself as a calendar-day math helper but its main entry dist/index.mjs, the default exports target embeds a Linux x86-...