libheif:file_fuzzer: Heap-buffer-overflow in HeifPixelImage::scale_nearest_neighbor

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=4847092626685952 Project: libheif Fuzzing Engine: libFuzzer Fuzz Target: filefuzzer Job Type: libfuzzerasani386libheif Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

libheif:file_fuzzer: Negative-size-param in HeifPixelImage::fill_RGB_16bit

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=4782198220980224 Project: libheif Fuzzing Engine: libFuzzer Fuzz Target: filefuzzer Job Type: libfuzzerasani386libheif Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash Stat...

MiracleLinux 7 : firefox-128.5.1-1.0.1.el7.AXS7 (AXSA:2024-9409:41)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-9409:41 advisory. firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims CVE-2024-11694 firefox: thunderbird: Unhandled Exception in Add-on...

MiracleLinux 8 : thunderbird-91.2.0-1.el8.ML.1 (AXSA:2021-2482:19)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-2482:19 advisory. Mozilla: Use-after-free in MessageTask CVE-2021-38496 Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2...

MiracleLinux 8 : thunderbird-128.2.0-1.el8_10.ML.1 (AXSA:2024-8858:20)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8858:20 advisory. thunderbird: 115.15/128.2 mozilla: Type confusion when looking up a property name in a with block CVE-2024-8381 mozilla: Internal event interfaces...

MiracleLinux 8 : firefox-91.2.0-4.el8.ML.1 (AXSA:2021-2461:28)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-2461:28 advisory. Mozilla: Use-after-free in MessageTask CVE-2021-38496 Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2...

MiracleLinux 7 : kernel-3.10.0-327.28.2.el7 (AXSA:2016-647:05)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-647:05 advisory. The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the operating...

MiracleLinux 7 : firefox-91.2.0-5.0.1.el7.AXS7 (AXBA:2021-2506:30)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXBA:2021-2506:30 advisory. - crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0,...

MiracleLinux 4 : openldap-2.4.23-34.AXS4.1 (AXSA:2014-041:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-041:01 advisory. OpenLDAP is an open source suite of LDAP Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols for accessing...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000640)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000640 advisory. fs/overlayfs/copyup.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service dentry reference le...

MiracleLinux 3 : openldap-2.3.43-27.0.1.AXS3 (AXSA:2014-236:01)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2014-236:01 advisory. OpenLDAP is an open source suite of LDAP Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols for accessing...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001828)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001828 advisory. fs/overlayfs/copyup.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service dentry reference le...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003127)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003127 advisory. The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mountin...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002918)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002918 advisory. The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002135)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002135 advisory. fs/overlayfs/copyup.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service dentry reference le...

ROS-20260114-7329

A vulnerability in the ovlencoderealfh fs/overlayfs/copyup.c and showmarkfhandle fs/notify/fdinfo.c functions of the Linux operating system kernel is related to a flaw in the use of assert. Exploitation of the vulnerability allows an attacker to cause a denial of service...

MiracleLinux 9 : kernel-5.14.0-570.25.1.el9_6 (AXSA:2025-10697:52)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10697:52 advisory. kernel: ipv6: mcast: extend RCU protection in igmp6send CVE-2025-21759 kernel: ovl: fix UAF in ovldentryupdatereval by moving dput in ovllinkup...

SUSE SLED15 / SLES15 Security Update : libheif (SUSE-SU-2026:0087-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0087-1 advisory. - CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay...

Security update for libheif

This update for libheif fixes the following issues: CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:0087-1 Security update for libheif

This update for libheif fixes the following issues: - CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735...