Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2026_88164)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

Amazon Linux 2 : wireshark (ALAS-2026-4006)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4006 advisory. SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-95389 Heap buffer...

SUSE CVE-2026-98882

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

SUSE CVE-2026-98893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...

SUSE CVE-2026-98912

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event sndseqossread checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It...

[slackware-security] brotli

New brotli packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/brotli-1.2.1-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: A buffer overflow vulnerability in the Brotli decoder...

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

EUVD-2026-104634

Pillow: Heap buffer overflow in FlashPix FPX JPEG decoding leads to code execution...

GHSA-5X8W-8JJ5-Q52H Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

CLSA-2026-1792791669 xorg-x11-server-Xwayland: Fix of 8 CVEs

CVE-2026-88812: Use-after-free/double free in XKB CheckSetDoodad: doodad text pointer left dangling after free when reading the font string fails - CVE-2026-93516: Use-after-free in DIX: passive grabs keep dangling pointers to a removed input device grab-device / modifierDevice - CVE-2026-93517:...

CVE-2026-98827

A flaw was found in the Linux kernel's ath9khtc wireless network driver. An attacker transmitting large network packets can trigger a Denial of Service DoS or system crash through memory corruption. This issue occurs because the driver limits aggregated transmit packets only by count rather than...

CLSA-2026-1792779937 thunderbird: Fix of 56 CVEs

update to 153.5.0 ESR MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5 - drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch, their fixes are part of 153.5.0 - stop packaging rnp-cli and rnpkeys: upstream no longer installs them bug 2068130; librnp.so is still shipped -...

DEBIAN-CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2023-7356

A flaw was found in the Linux kernel's Bluetooth subsystem. An adjacent attacker within Bluetooth range could exploit this flaw by broadcasting specially crafted Bluetooth Low Energy LE periodic advertisement packets. Because incoming advertisement data was copied into internal socket buffers...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

Versions of ConnMan through 2.0 are vulnerable to a stack-based buffer overflow in the get_domains function located in gdhcp/client.c. The flaw occurs because the software copies a fixed 1025 bytes from a DHCPv6 DOMAIN_LIST (option 24) into a 1026-byte stack buffer regardless of the actual option...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

EUVD-2026-109113

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-97631

A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service DoS...