Google Chrome resource management error vulnerability

Google Chrome versions prior to 156.0.8078.47 contain a resource management error vulnerability. This vulnerability stems from use-after-free issues in WebAppInstalls; remote attackers can exploit it by sending specially crafted HTML pages to execute arbitrary code within a sandbox...

Oracle Java SE resource management error vulnerability

Versions 8u503, 21.0.12, 25.0.4, and 27 of Oracle Java SE, as well as version 21.3.19.1.1 of Oracle GraalVM Enterprise Edition contain a resource management error vulnerability. This vulnerability stems from improper use-after-free issues in JavaFX components. Unauthenticated attackers can exploi...

Mozilla Thunderbird resource management error vulnerability

Versions of Mozilla Thunderbird prior to 158.0.1 contain a resource management error vulnerability. This vulnerability arises when the password for a security device—such as a smart card PIN or master password—is requested during the decryption of S/MIME messages. The prompt may appear to indicat...

Google Chrome resource management error vulnerability

Google Chrome on Android versions prior to 156.0.8078.47 contains a resource management error vulnerability. This vulnerability stems from post-free reuse in Performance APIs and may allow remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...

CLSA-2026-1790932414 libxml2: Fix of 2 CVEs

CVE-2025-7425: clear the attribute type through the live attr argument in xmlRemoveID instead of id-attr, which read the xmlID already freed by xmlHashRemoveEntry - CVE-2022-23308: normalize the ID value in xmlRemoveID after it is read from the attribute instead of before, where the pointer was...

CLSA-2025-1755708467 libxml2: Fix of 2 CVEs

CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in valid.c - CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c...

SUSE-SU-2026:24260-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR MFSA 2026-108, bsc1284493: - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary...

xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling

A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the...

xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension XKB geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a...

Important: Red Hat Security Advisory: xorg-x11-server-Xwayland security update

An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

OPENSUSE-SU-2026:22139-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR MFSA 2026-108, bsc1284493: - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary...

CLSA-2026-1780142646 Fix of 10 CVEs

CVE-2026-23193 - scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount CVE-2026-23193 CVE-2025-71093 - e1000: fix OOB in e1000tbishouldaccept CVE-2025-71093 CVE-2025-71116 - libceph: make decodepool more resilient against corrupted osdmaps CVE-2025-71116 CVE-2025-71136 - media:...

CLSA-2026-1792419819 Fix of 74 CVEs

Bump kernel ABI to 30: ship the ELS kernel as 4.19.0-30-, distinct from the prior 4.19.0-29. CVE-2021-3493 - vfs: move capconvertnscap call into vfssetxattr CVE-2021-3493 - ecryptfs: fix uid translation for setxattr on security.capability CVE-2021-3493 CVE-2025-23142 - sctp: detect and prevent...

xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension XKB geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a...

xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling

A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the...

Important: Red Hat Security Advisory: xorg-x11-server-Xwayland security update

An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CLSA-2026-1787304608 kernel-uek: Fix of 34 CVEs

Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek - sctp: don't free the ASCONF's own transport in DEL-IP processing CVE-2026-64564 - ocfs2/dlm: fix off-by-one in dlmmatchregions region comparison CVE-2026-53309 - ocfs2/dlm: validate qrnumregions in dlmmatchregions CVE-2026-53043 - ixgbevf:...

CLSA-2026-1780301172 Fix of 19 CVEs

CVE-2025-38715 - hfs: fix slab-out-of-bounds in hfsbnoderead CVE-2025-38715 CVE-2023-53432 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 CVE-2025-39891 - wifi: mwifiex: Initialize the chanstats array to zero CVE-2025-39891 CVE-2025-38666 - net: appletalk: Fix...

kernel: Fix of 12 CVEs

drm/vmwgfx: Fix invalid reads in fence signaled events CVE-2024-36960 - afunix: Fix garbage collector racing against connect CVE-2024-26923 - ipv6: remove maxsize check inline with ipv4 CVE-2023-52340 - aoe: fix the potential use-after-free problem in aoecmdcfgpkts CVE-2023-6270 - smb: client:...

CLSA-2026-1786444011 kernel: Fix of 16 CVEs

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level CVE-2026-63807 - KVM: x86: Check for invalid/obsolete root after making MMU pages available CVE-2026-64561 - comedi: vmk80xx: fix bulk-buffer overflow CVE-2021-47474 - staging: vmeuser: Fix possible UAF in...