Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a 32-bit unsigned integer overflow in the XWD X Windows encoder, which could lead to an undersized heap buffer allocation. When writing an extremely...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Added a signal type check for dcn401 getphyd32clksrc Attempting to access link enc on a dpia link will cause a crash...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed an issue where engid could be negative, causing the streamenc regs array to be indexed out of bounds. The variable engid is used directly as an index into the streamenc regs array, which has only 5 elements...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a stack buffer overflow vulnerability in the MNG encoder. There were missing bounds checks, which could allow the stack to be corrupted by...

CVE-2026-71313

A flaw was found in rclone, a command-line program for syncing files. The local backend's filename encoder, when configured in certain ways, can improperly decode remote filenames. This allows an attacker to craft a source object that, when processed, can create or overwrite files outside the...

libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...

UBUNTU-CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

GHSA-7P4M-QXVV-G567 rclone: Local Encoding Path Traversal

Summary The local backend relies on its configurable filename encoder to prevent remote filename data from becoming operating-system path syntax. If a local destination uses an encoding that omits Dot, such as Slash, None, or Raw, a remote object's standard-encoded ．． component is decoded into an...

CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-71313

The CVE affects the rclone local backend (local.go) from v1.51.0 through v1.75.0. A faulty filename encoder allows certain encodings (Slash, None, Raw, or Windows-preserving backslash variants) to be decoded into an actual parent-directory component by filepath.Join, enabling an attacker-controll...

[SECURITY] [DSA 6411-1] aom security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6411-1 [email protected] https://www.debian.org/security/ Aron Xu August 05, 2026 https://www.debian.org/security/faq -...

Debian dsa-6411 : aom-tools - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6411 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6411-1 [email protected] https://www.debian.org/securit...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

EEF-CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments

Summary Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a...

SUSE SLES12: ImageMagick-config-6-SUSE / ImageMagick-config-6-upstream / etc (SUSE-SU-2026:3412-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3412-1 advisory. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62946: integer overfl...

The vulnerability of the MNG encoder in the console-based image editing tool ImageMagick allows a hacker to execute arbitrary code.

The vulnerability of the MNG encoder in the console-based image editing tool ImageMagick is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3414-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3414-1 advisory. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575....

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:3413-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3413-1 advisory. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575....