Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2023-000319)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000319 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1

Summary webkit2gtk3-jsc, gstreamer1-plugins-base, libtiff, and giflib are bundled with IBM Optim as part of its base OS image; Eclipse Jetty jetty-io is used for HTTP server infrastructure; Apache ZooKeeper zookeeper is used for distributed coordination; Jackson Core jackson-core is used for JSON...

CVE-2026-58264

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

EUVD-2026-83374

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-58264 FluidSynth: Heap-based buffer overrun

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109827 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE...

CVE-2026-91958: Out-of-bounds Read

FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xfdetectmonitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger out-of-bounds heap read and write...

Astra Linux – Vulnerability in Cpio

In GNU Cpio from version 2.13 onwards, attackers can execute arbitrary code by using a crafted pattern file. This occurs due to a dstring.c dsfgetstr integer overflow, which triggers an out-of-bounds heap write. NOTE: It is unclear whether there are common cases where the pattern file, associated...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a 32-bit unsigned integer overflow in the XWD X Windows encoder, which could lead to an undersized heap buffer allocation. When writing an extremely...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions of ImageMagick below 14.8.2 contain insecure functions: SeekBlob, which allows advancing the stream offset beyond the current end without increasing capacity, and WriteBlob, which expands the...

Astra Linux – Vulnerability in libstb

STBVorbis is a single-file library licensed under MIT that processes OGG Vorbis files. A maliciously crafted file may cause memory writes to exceed the allocated heap buffer in startdecoder. The root cause of this issue is a potential integer overflow in sizeofchar f-commentlistlength, which may...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains a problem where integers may be truncated or wrapped around when processing 32-bit builds, which could lead to an out-of-bounds...

Astra Linux – Vulnerability in grub2

A crafted 16-bit grayscale PNG image may lead to an out-of-bounds write in the heap area. An attacker may exploit this to cause heap data corruption or, ultimately, arbitrary code execution and circumvent secure boot protections. This issue is highly complex to exploit; an attacker needs to perfo...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions, a heap write operation beyond its bounds could occur. This issue has been fixed in versions 6.9.13-48 an...

AZL-100680 CVE-2026-89494 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

DEBIAN-CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

CVE-2026-88051

Tesseract (open-source OCR engine) versions 5.5.3 and earlier contain a heap out-of-bounds write in the callback form of GenericVector::read (src/ccutil/genericvector.h). The function reads independent reserved and size_used_ int32 fields from a .traineddata model without a cap or invariant check...

SUSE CVE-2026-53938

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...

CVE-2026-59679: Out-of-bounds Write

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-53938

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms "alg" = "A128KW", "A192KW", "A256KW" does not validate the length of the attacker-supplied "encryptedke...