329311 matches found
SUSE SLES15 Security Update : kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4889-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4889-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.78 fixes various security issues: The following security issues were fixed: -...
Amazon Linux 2 : nginx (ALASNGINX1-2026-017)
The version of nginx installed on the remote host is prior to 1.30.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-017 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive...
Amazon Linux 2 : qemu (ALAS-2026-4009)
The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4009 advisory. NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE: Fixed...
Amazon Linux 2 : alsa-lib (ALAS-2026-4041)
The version of alsa-lib installed on the remote host is prior to 1.1.4.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4041 advisory. alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte...
Medium: alsa-lib
Issue Overview: alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state fil...
Important: wireshark
Issue Overview: TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service CVE-2026-95386 The spdyassembledataframes function in epan/dissectors/packet-spdy.c accumulates SPDY DATA frame payload fragment lengths into a uint32t variable named datalen without any overflow protection...
SUSE CVE-2026-98882
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...
SUSE CVE-2026-98893
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...
SUSE CVE-2026-98912
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event sndseqossread checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It...
CLSA-2026-1791196479 expat: Fix of 2 CVEs
CVE-2026-102633: reject a size that would overflow the allocation in expatrealloc instead of relying on an assert that release builds compile out...
CLSA-2026-1791791753 expat: Fix of 2 CVEs
CVE-2026-102633: reject a size that would overflow the allocation in expatrealloc instead of relying on an assert that release builds compile out...
SUSE CVE-2026-115484
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the...
Exploit for Classic Buffer Overflow in Citrix Netscaler_Application_Delivery_Controller
netscaler-cve-2026-88775-check Standalo...
CLSA-2026-1792798495 Fix CVE(s): CVE-2026-15176
SECURITY UPDATE: heap buffer overflow via post-rewrite URI to path mapping with alias - debian/patches/CVE-2026-15176.patch: in ngxhttpmapuritopath, reject the mapping for a location using "alias" when r-urichanged is set, so a rewritten URI shorter than the location prefix is no longer mapped to...
CLSA-2026-1791463004 ghostscript: Fix of 3 CVEs
CVE-2026-39919: heap buffer overflow in the JPEG 2000 output adapter with subsampled components base/sjpxopenjpeg.c - CVE-2026-103226: stack buffer overflow in the pdfwrite Type 1 to Type 2 font converter control stack devices/vector/gdevpsfx.c...
CVE-2026-89879
A flaw was found in the Linux kernel's s2255 media driver. The driver fails to properly validate the size of JPEG frames received from a device. A malicious or malfunctioning device can provide an oversized jpgsize value, causing a buffer overflow when the data is copied. This could allow an...
[slackware-security] brotli
New brotli packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/brotli-1.2.1-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: A buffer overflow vulnerability in the Brotli decoder...
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...
GHSA-5X8W-8JJ5-Q52H Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...
