CVE-2026-89879

A flaw was found in the Linux kernel's s2255 media driver. The driver fails to properly validate the size of JPEG frames received from a device. A malicious or malfunctioning device can provide an oversized jpgsize value, causing a buffer overflow when the data is copied. This could allow an...

[slackware-security] brotli

New brotli packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/brotli-1.2.1-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: A buffer overflow vulnerability in the Brotli decoder...

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

GHSA-5X8W-8JJ5-Q52H Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

EUVD-2026-104634

Pillow: Heap buffer overflow in FlashPix FPX JPEG decoding leads to code execution...

CLSA-2026-1792791669 xorg-x11-server-Xwayland: Fix of 8 CVEs

CVE-2026-88812: Use-after-free/double free in XKB CheckSetDoodad: doodad text pointer left dangling after free when reading the font string fails - CVE-2026-93516: Use-after-free in DIX: passive grabs keep dangling pointers to a removed input device grab-device / modifierDevice - CVE-2026-93517:...

OSEC-2026-25 Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event

ANT-2026-0JXJVEVY Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

CVE-2026-98827

A flaw was found in the Linux kernel's ath9khtc wireless network driver. An attacker transmitting large network packets can trigger a Denial of Service DoS or system crash through memory corruption. This issue occurs because the driver limits aggregated transmit packets only by count rather than...

CVE-2026-79982

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

EUVD-2026-109145

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CLSA-2026-1792779937 thunderbird: Fix of 56 CVEs

update to 153.5.0 ESR MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5 - drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch, their fixes are part of 153.5.0 - stop packaging rnp-cli and rnpkeys: upstream no longer installs them bug 2068130; librnp.so is still shipped -...

DEBIAN-CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2023-7356

A flaw was found in the Linux kernel's Bluetooth subsystem. An adjacent attacker within Bluetooth range could exploit this flaw by broadcasting specially crafted Bluetooth Low Energy LE periodic advertisement packets. Because incoming advertisement data was copied into internal socket buffers...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

EUVD-2026-109113

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

Versions of ConnMan through 2.0 are vulnerable to a stack-based buffer overflow in the get_domains function located in gdhcp/client.c. The flaw occurs because the software copies a fixed 1025 bytes from a DHCPv6 DOMAIN_LIST (option 24) into a 1026-byte stack buffer regardless of the actual option...