PT-2026-105144

phar tar number parses the octal size field of a TAR header into a uint32 t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets...

Rocky Linux 9.6 [TuxCare] Security Update: spice-vdagent (ALMALINUX9.6:CLSA-2026:1786717202)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786717202 advisory. - A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785922090)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785922090 advisory. - A flaw was found in GIMP's PSP Paint Shop Pro file parser. A remote attacker could exploit an integer overflow vulnerability in th...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2025_19713)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202519713 advisory. libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup CVE-2025-4945 libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP...

AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1781354122)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781354122 advisory. - A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, whe...

CentOS Linux 8.5 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789668093)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789668093 advisory. - In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. CVE-2026-86140 - xmlregexp in...

Rocky Linux 9 [CIQ] Security Update: iputils / iputils-debuginfo / iputils-debugsource / iputils-ninfod / etc (crlsa-2025_17558)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517558 advisory. iputils: iputils integer overflow CVE-2025-48964 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus ha...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging (crlsa-2020_1317)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201317 advisory. ICU: Integer overflow in UnicodeString::doAppend CVE-2020-10531 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

AlmaLinux 9.6 [TuxCare] Security Update: libvpx / libvpx-devel / libvpx-utils (ALMALINUX9.6:CLSA-2026:1777973407)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777973407 advisory. - There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc with a large value of the dw, dh, or align...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1781354122)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781354122 advisory. - A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that,...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1771000442)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771000442 advisory. - A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for...

Rocky Linux 9 [CIQ] Security Update: libvpx / libvpx-debuginfo / libvpx-debugsource / libvpx-devel (crlsa-2024_9827)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249827 advisory. libvpx: Integer overflow in vpximgalloc CVE-2024-5197 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessu...

Rocky Linux 9 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-libs-debuginfo / krb5-pkinit / etc (crlsa-2022_8637)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20228637 advisory. krb5: integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 9 [CIQ] Security Update: vsftpd / vsftpd-debuginfo / vsftpd-debugsource (crlsa-2026_0605)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260605 advisory. vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing CVE-2025-14242 Tenable has extracted the preceding description block directly...

CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1787086661)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787086661 advisory. - libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. CVE-2026-56407 Note that Ness...

Rocky Linux 10.2 [CIQ] Security Update: bsdtar / bsdtar-debuginfo / libarchive / libarchive-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_69553)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669553 advisory. libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header CVE-2026-15028 libarchive: libarchive: Signed Integer...

Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc (crlsa-2024_3089)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243089 advisory. gstreamer-plugins-good: integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: openexr / openexr-debuginfo / openexr-debugsource / openexr-devel / etc Multiple Vulnerabilities (crlsa-2026_38499)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202638499 advisory. OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing CVE-2026-41142 OpenEXR: OpenEXR: Information disclosure and denial of...

Rocky Linux 9 [CIQ] Security Update: gegl04 / gegl04-debuginfo / gegl04-debugsource / gegl04-devel / etc (crlsa-2026_62170)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202662170 advisory. gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2025:1758709744)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758709744 advisory. - GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary...