Fedora 46 : ruby (2026-fbf03424ec)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbf03424ec advisory. Update resolv gem in ruby.src to resolve security issues. Tenable has extracted the preceding description block directly from the Fedora security...

Oracle Outside In Technology GEM File Parsing Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps

Summary Multiple vulnerabilities were addressed in IBM Aspera Enterprise Webapps version 1.0.6 Vulnerability Details CVEID:CVE-2026-54500 DESCRIPTION: Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053224)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053224 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mappe...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053241)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053241 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add 0 size check to mtkdrmgemobj Add a check to mtkdrmgeminit if we attempt to...

OESA-2026-3667 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass...

OESA-2026-3666 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass...

AZL-99684 CVE-2026-80888 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

CVE-2026-80888 drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

EUVD-2026-71638

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

CVE-2026-80888

This Linux kernel vulnerability affects the drm/vmwgfx paravirtualized graphics driver. The function ttm_prime_fd_to_handle() returns -ENOSYS when an imported fd's dma_buf->ops do not match the ttm_object_device's ops, but fails to release the reference previously acquired by dma_buf_get(). As...

CVE-2026-80888: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

PT-2026-91801

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma buf reference on foreign-fd prime import ttm prime fd to handle returns -ENOSYS when the imported fd's dma buf-ops do not match the ttm object device's ops, but does so without releasing the reference acquire...

ethosu Gem Copy and Validate Buffer Overflow DoS

The vulnerability of the ethosugemcmdstreamcopyandvalidate function in the drivers/accel/ethosu/ethosugem.c driver for Linux computing devices involves improper release of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

ethosu Gem Copy and Validate

The vulnerability of the ethosugemcmdstreamcopyandvalidate function in the drivers/accel/ethosu/ethosugem.c driver for Linux computing devices involves the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the...

GHSA-MVXR-6M87-MV2Q Mail: Email address spoofing via malformed RFC 2047 encoded-words

Summary Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded...

EUVD-2026-69609

Mail: Email address spoofing via malformed RFC 2047 encoded-words...

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Summary Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded...

SUSE CVE-2026-63435

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode used a single Stringmatch and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...