OESA-2026-2813 python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fixes: urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code...

PT-2026-55964

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description The bdf char function in PIL/BdfFontFile.py reads the BBX width and height fields from a BDF font file and passes these attacker-controlled dimensions to Image.new without invoking Image. decompressi...

PT-2026-55965

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description In the Python imaging library, the GdImageFile. open function in PIL/GdImageFile.py reads image dimensions from the GD 2.x header and stores them in self. size without invoking Image. decompression...

SUSE SLES15: libpacemaker-devel / libpacemaker3 / pacemaker / pacemaker-cli / etc (SUSE-SU-2026:2742-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2742-1 advisory. This update for pacemaker fixes the following issue - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381...

PT-2026-55963

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description The FontFile.compile function in the PIL/FontFile.py module fails to call Image. decompression bomb check when assembling per-glyph images into a combined bitmap using Image.new"1", xsize, ysize. Thi...

PT-2026-55962

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description In the load bitmaps function within PIL/PcfFontFile.py, glyph dimensions are read from the PCF METRICS section and passed to Image.frombytes without invoking Image. decompression bomb check. This...

Security update for pacemaker

This update for pacemaker fixes the following issue CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:2742-1 Security update for pacemaker

This update for pacemaker fixes the following issue - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381...

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

...

Security update for pacemaker (important)

openSUSE security update: security update for pacemaker ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21196-1 Rating: important References: bsc1268381 Cross-References: CVE-2026-10649 CVSS scores: CVE-2026-10649 SUSE : 7.5...

openSUSE 16: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (openSUSE-SU-2026:21196-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21196-1 advisory. - CVE-2026-10649: Fixed denial of service via integer overflow in remote message decompression bsc1268381. Tenable has extracted the preceding descripti...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

SUSE SLES15: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (SUSE-SU-2026:2701-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2701-1 advisory. This update for pacemaker fixes the following issue - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381...

SUSE SLES15: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (SUSE-SU-2026:2716-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2716-1 advisory. This update for pacemaker fixes the following issue - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381...

Уязвимость компонента PDF браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код

Уязвимость компонента PDF браузеров Google Chrome и Microsoft Edge связана с возможностью использования памяти после освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с помощью специально созданного PDF-файла...

vim: command injection when decompressing .tgz archives

A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape without the special flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service DoS by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory...

Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service DoS by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory...

Security update for pacemaker

This update for pacemaker fixes the following issues: CVE-2026-10649: Fixed denial-of-service via integer overflow in remote message decompression bsc1268381. Changes for pacemaker: Update to version 2.1.10+20260618.4bca25e3c1: libcrmcommon: Add additional checks to pcmkremotemessagexml...