httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias

A flaw was found in httpd's modvhostalias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause...

AZL-111041 CVE-2026-111497 affecting package nodejs for versions less than 24.22.1-1

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

AZL-111005 CVE-2026-111497 affecting package rr 5.8.0-2

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

AZL-111518 CVE-2026-111497 affecting package p7zip 16.02-23

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

DEBIAN-CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

AZL-110384 CVE-2026-111497 affecting package brotli for versions less than 1.2.1-1

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

ALPINE-CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

Microsoft Exchange Online Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

EUVD-2026-108169

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

CLSA-2026-1792636681 mariadb: Fix of 6 CVEs

CVE-2026-86047: quote identifiers and values in SHOW CREATE TABLE/USER, SHOW GRANTS, mariadb-dump, mariadb-show and mariadb-convert-table-format - CVE-2026-92262: refuse mysql50 names that mix up with table names in the table cache and on disk - CVE-2026-85746: fix heap buffer overflow in...

PHP2Shell

PHP2Shell CVE-2026-109618 PHP 8.5.4 may allow for a buffer...

CLSA-2026-1792628290 openexr: Fix of 11 CVEs

CVE-2026-54920: validate the data window and pre-initialise every level pointer in OpenEXRUtil Image::resize, so an overflowing level size no longer leaves clearLevels deleting uninitialised ImageLevel pointers - CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in...

Important: Red Hat Security Advisory: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

libreoffice: stack buffer overflow in CFF font hint handling

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

libreoffice: heap buffer overflow in PDF import stream handling

A flaw was found in LibreOffice. When a user imports a specially crafted PDF document with LibreOffice Draw, a heap-based buffer overflow can occur due to improper validation of the stream length. This issue can cause memory corruption, resulting in an application crash...

libreoffice: stack buffer overflow in CFF to Type 1 font conversion

A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 bsc1284619: CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

SUSE-SU-2026:4858-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 bsc1284619: - CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...