[slackware-security] libXi

New libXi packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libXi-1.8.4-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Out-of-bounds read in libXi's XQueryDeviceState...

CVE-2026-110758

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

CVE-2026-110758

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

CVE-2026-110606

A flaw was found in libdxfrw. An out-of-bounds read vulnerability occurs when parsing drawing DWG files due to improper handling of non-null-terminated buffers in the file header reader. By convincing a user to open a specially crafted DWG file, an attacker could trigger an application crash,...

CVE-2026-111275

A flaw was found in nifticlib. This vulnerability can result in a Denial of Service DoS or memory corruption when an application processes a specially crafted NIfTI-2 image file. Due to missing range validation on dimension header values, an attacker could supply a malicious file that triggers a...

CVE-2026-110716

A flaw was found in unshield. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the application. By tricking a user or system into processing a specially crafted InstallShield cabinet file with manipulated header offsets or file counts, an attacker can trigger an...

CVE-2026-111130

A flaw was found in OpenSlide. By convincing a user or automated service to open a specially crafted MIRAX slide file, an attacker can trigger an out-of-bounds memory read in the format reader due to improper index validation. This vulnerability primarily results in an application crash, causing ...

CVE-2026-110597

A flaw was found in tinyexr. When processing multi-part image files, the library fails to properly track buffer boundaries during header parsing, leading to an out-of-bounds read. An attacker could exploit this vulnerability by convincing a user or system to open a specially crafted EXR file,...

CVE-2026-62438 Gimp: gimp: paa integer overflow out-of-bounds read

A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...

CVE-2026-62438

A flaw in GIMP allows an attacker to cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by tricking a user into opening or previewing a specially crafted Bohemia Interactive (PAA) texture file . The root cause is an integer overflow during image dimension calculatio...

CVE-2026-62438 Gimp: gimp: paa integer overflow out-of-bounds read

A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...

CVE-2026-61726

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

EUVD-2026-42393

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination...

CVE-2026-61726

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

EUVD-2026-103144

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-107928

A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash...

CVE-2026-46472

A flaw was found in gstreamer1-plugins-good. When processing a crafted MP4 media file, the isomp4 plugin's qtdemuxparsechnl function can read past the boundary of a global array. A remote attacker could exploit this vulnerability by enticing a user or service to process a specially crafted file,...

CVE-2026-111722

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id ...

CVE-2026-111716

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111689

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/departmentId with arbitrary department ids to retrieve usernames,...