25073 matches found
ALSA-2026:27819 Important: evince security update
The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files, and, with additional back-ends, also the Device Independent File format DVI files. Security Fixes: atril: evince: xreader: PDF /GoToR action argv...
[SECURITY] Fedora 43 Update: erlang-gun-2.4.1-1.fc43
Erlang HTTP client with support for HTTP/1.1, HTTP/2, Websocket and more...
[SECURITY] Fedora 44 Update: perl-Crypt-PBKDF2-0.261630-1.fc44
PBKDF2 is a secure password hashing algorithm that uses the techniques of "key strengthening" to make the complexity of a brute-force attack arbitrarily hig h. PBKDF2 uses any other cryptographic hash or cipher by convention, usually HMAC-SHA2, but Crypt::PBKDF2 is fully pluggable, and allows for...
Oracle Linux 8 : redis:6 (ELSA-2026-26008)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26008 advisory. 6.2.22-1.0.1 - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 6.2.22-1 - rebase to 6.2.22 for CVE-2026-25243 Tenable has extracted the...
[SECURITY] Fedora 43 Update: perl-Config-IniFiles-3.001000-1.fc43
Config::IniFiles provides a way to have readable configuration files outside your Perl script. Configurations can be imported inherited, stacked,..., sections can be grouped, and settings can be accessed from a tied hash...
DEBIAN-CVE-2026-9375
Bulletin has no description...
CVE-2026-9375
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-38064
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the maxlength protection introduced in version 2.6.0 to mitigate CVE-2025-66471...
CVE-2026-9375 Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the maxlength protection introduced in version 2.6.0 to mitigate CVE-2025-66471...
CVE-2026-9375
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-9375
CVE-2026-9375 is disclosed by multiple advisories tied to python-urllib3. The issue is a decompression-bomb style bypass in urllib3’s streaming API with Brotli support, enabling DoS via oversized decompressed data. Public details confirm affected software (python-urllib3) and the root cause (deco...
CVE-2026-49286 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so PHAR://, Phar://, etc...
[SECURITY] Fedora 43 Update: perl-Archive-Tar-3.04-522.fc43
Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support...
[SECURITY] Fedora 44 Update: ocserv-1.5.0-2.fc44
OpenConnect server ocserv is an SSL VPN server. Its purpose is to be a secure, small, fast and configurable VPN server. It implements the OpenConnect SSL VPN protocol, and has also currently experimental compatibility with clients using the AnyConnect SSL VPN protocol. The OpenConnect VPN protoco...
PT-2026-51014
Name of the Vulnerable Software and Affected Versions urllib3 version 2.6.3 Brotli version 1.2.0 Description A decompression bomb bypass exists in the streaming API preload content=False when Brotli support is used. This occurs because three independent code paths in response.py bypass the max...
Mozilla Firefox Thunderbird Bypass Security Restriction
The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird lies in a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker to circumvent existing security restrictions remotely...
DOM Component Spoofing
The vulnerability of the DOM component: The Core and HTML browsers of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are vulnerable to attacks that involve bypassing authentication procedures through spoofing. Exploiting this vulnerability allows attackers to carry out spoofing...
Mozilla Firefox Thunderbird Buffer Overflow
The vulnerability in Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service interruptions...
DOM Component Data Compromise
Vulnerability of the DOM component: Device interfaces of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are vulnerable due to operations that go beyond the buffer in memory. Exploitation of this vulnerability can allow a remote attacker to compromise the integrity and accessibilit...