SUSE CVE-2026-98882

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

SUSE CVE-2026-98893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...

SUSE CVE-2026-98912

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event sndseqossread checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It...

CLSA-2026-1791196479 expat: Fix of 2 CVEs

CVE-2026-102633: reject a size that would overflow the allocation in expatrealloc instead of relying on an assert that release builds compile out...

CLSA-2026-1791791753 expat: Fix of 2 CVEs

CVE-2026-102633: reject a size that would overflow the allocation in expatrealloc instead of relying on an assert that release builds compile out...

SUSE CVE-2026-115484

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the...

Exploit for Classic Buffer Overflow in Citrix Netscaler_Application_Delivery_Controller

netscaler-cve-2026-88775-check Standalo...

CLSA-2026-1792798495 Fix CVE(s): CVE-2026-15176

SECURITY UPDATE: heap buffer overflow via post-rewrite URI to path mapping with alias - debian/patches/CVE-2026-15176.patch: in ngxhttpmapuritopath, reject the mapping for a location using "alias" when r-urichanged is set, so a rewritten URI shorter than the location prefix is no longer mapped to...

CLSA-2026-1791463004 ghostscript: Fix of 3 CVEs

CVE-2026-39919: heap buffer overflow in the JPEG 2000 output adapter with subsampled components base/sjpxopenjpeg.c - CVE-2026-103226: stack buffer overflow in the pdfwrite Type 1 to Type 2 font converter control stack devices/vector/gdevpsfx.c...

CVE-2026-89879

A flaw was found in the Linux kernel's s2255 media driver. The driver fails to properly validate the size of JPEG frames received from a device. A malicious or malfunctioning device can provide an oversized jpgsize value, causing a buffer overflow when the data is copied. This could allow an...

[slackware-security] brotli

New brotli packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/brotli-1.2.1-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: A buffer overflow vulnerability in the Brotli decoder...

EUVD-2026-104634

Pillow: Heap buffer overflow in FlashPix FPX JPEG decoding leads to code execution...

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

GHSA-5X8W-8JJ5-Q52H Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

CLSA-2026-1792791669 xorg-x11-server-Xwayland: Fix of 8 CVEs

CVE-2026-88812: Use-after-free/double free in XKB CheckSetDoodad: doodad text pointer left dangling after free when reading the font string fails - CVE-2026-93516: Use-after-free in DIX: passive grabs keep dangling pointers to a removed input device grab-device / modifierDevice - CVE-2026-93517:...

OSEC-2026-25 Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event

ANT-2026-0JXJVEVY Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

CVE-2026-98827

A flaw was found in the Linux kernel's ath9khtc wireless network driver. An attacker transmitting large network packets can trigger a Denial of Service DoS or system crash through memory corruption. This issue occurs because the driver limits aggregated transmit packets only by count rather than...

CVE-2026-79982

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

EUVD-2026-109145

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CLSA-2026-1792779937 thunderbird: Fix of 56 CVEs

update to 153.5.0 ESR MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5 - drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch, their fixes are part of 153.5.0 - stop packaging rnp-cli and rnpkeys: upstream no longer installs them bug 2068130; librnp.so is still shipped -...