Important: Red Hat Security Advisory: compat-libtiff3 security update

An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

Important: Red Hat Security Advisory: compat-libtiff3 security update

An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

Updated qemu packages fix many security vulnerabilities

This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the plperl function when returning a tied hash. An attacker can execute arbitrary code as the operating system user running the database by crafting a malicious function body. Remediation A fix was pushed...

CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

AZL-95765 CVE-2026-70461 affecting package rsync 3.4.3-1

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

ALPINE-CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

CVE-2026-70458

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...

CVE-2026-70456

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the readargs function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is...

AZL-95843 CVE-2026-70456 affecting package rsync 3.4.3-1

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the readargs function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is...

AZL-95759 CVE-2026-70458 affecting package rsync 3.4.3-1

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...

jansi: org.fusesource.jansi/jansi: Jansi: Heap buffer overflow leads to Denial of Service

A flaw was found in Jansi. A heap buffer overflow vulnerability exists in the Jansi Java Native Interface JNI 'ioctl' wrapper. This is due to a lack of size verification for the argument array before the system call, which can lead to heap corruption. An attacker could exploit this to cause...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.3 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

jansi: org.fusesource.jansi/jansi: Jansi: Heap buffer overflow leads to Denial of Service

A flaw was found in Jansi. A heap buffer overflow vulnerability exists in the Jansi Java Native Interface JNI 'ioctl' wrapper. This is due to a lack of size verification for the argument array before the system call, which can lead to heap corruption. An attacker could exploit this to cause...

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...

CVE-2026-70456 rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the readargs function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is...

CVE-2026-70456 rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the readargs function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is...

CVE-2026-70456

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the readargs function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is...