Important: Red Hat Security Advisory: gvfs security update

An update for gvfs is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

CLSA-2026-1792508988 gawk: Fix of 3 CVEs

CVE-2023-4156: builtin.c formattree: when collecting positional field widths or precisions, check for wrap around to negative values - CVE-2026-40469: builtin.c subcommon: check for overflow in the result buffer size calculation using 64-bit math, failing with a fatal error instead of corrupting...

CVE-2025-71436

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 byt...

MGASA-2026-0529 Updated x11-server, x11-server-xwayland, tigervnc packages fixes security vulnerabilities and a regression that crashes the X server with AMD GPUs

XKB SetGeometry TextDoodad Double Free. CVE-2026-88812 Present Extension Cross-Window Notify Use-After-Free. CVE-2026-93515 XInput Passive Grab modifierDevice Use-After-Free. CVE-2026-93516 GLX RenderLarge Heap Buffer Overflow. CVE-2026-93517 XKB ResizeKeyType Numeric Truncation. CVE-2026-93518...

Updated x11-server, x11-server-xwayland, tigervnc packages fixes security vulnerabilities and a regression that crashes the X server with AMD GPUs

XKB SetGeometry TextDoodad Double Free. CVE-2026-88812 Present Extension Cross-Window Notify Use-After-Free. CVE-2026-93515 XInput Passive Grab modifierDevice Use-After-Free. CVE-2026-93516 GLX RenderLarge Heap Buffer Overflow. CVE-2026-93517 XKB ResizeKeyType Numeric Truncation. CVE-2026-93518...

CVE-2025-71436

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 byt...

CVE-2025-71436 Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 byt...

EUVD-2025-211138

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 byt...

CVE-2025-71436

The Raptor RDF Syntax Library versions 2.0.15 through 2.0.16 are vulnerable to a heap-based buffer overflow in the raptor_new_term_from_counted_literal() function. The root cause is the truncation of the language tag length to an unsigned char . An attacker can exploit this by providing Turtle, T...

CVE-2025-71436 Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 byt...

CVE-2025-71436 Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 byt...

CVE-2026-96402

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

CVE-2026-91186

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...

CVE-2026-91189

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...

CLSA-2026-1792508765 bluez: Fix of 5 CVEs

CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint codec capability storage and validate cached capabilities on load - CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing by bounding media item and folder names to the received packet length...

gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

Important: Red Hat Security Advisory: gvfs security update

An update for gvfs is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

EUVD-2026-105040

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...

Important: Red Hat Security Advisory: gvfs security update

An update for gvfs is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...