Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 For more details about the security...

EulerOS Virtualization 2.11.0 : coreutils (EulerOS-SA-2026-3494)

According to the versions of the coreutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program ma...

USN-8697-1: GNU Core Utilities vulnerabilities

It was discovered that GNU Core Utilities sort had a heap buffer under-read in its begfield function. A local attacker could possibly use this issue to cause GNU Core Utilities to crash, resulting in a denial of service, or obtain sensitive information. CVE-2025-5278 It was discovered that GNU Co...

USN-8697-1 coreutils vulnerabilities

It was discovered that GNU Core Utilities sort had a heap buffer under-read in its begfield function. A local attacker could possibly use this issue to cause GNU Core Utilities to crash, resulting in a denial of service, or obtain sensitive information. CVE-2025-5278 It was discovered that GNU Co...

CVE-2025-71346

A flaw was found in Nokogiri, which packages a vulnerable version of libxml2. This heap-based buffer under-read vulnerability, located in the xmlSchemaIDCFillNodeTables function, can be triggered when processing untrusted XML Schemas or documents. A remote attacker could exploit this by providing...

CentOS 9 : glib2-2.68.4-29.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the glib2-2.68.4-29.el9 build changelog. - heap under-read in gkeyfilegetlocalestringlist CVE-2026-58014 - limit D-Bus auth line read length CVE-2026-15588 - off-by-one error in...

UBUNTU-CVE-2025-71346

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...

CVE-2025-71346

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8), introducing a heap-based buffer under-read in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The flaw is triggered when validating against an untrusted XML Schema, or when validating untrusted documents aga...

Oracle Linux 10 : glib2 (ELSA-2026-57015)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57015 advisory. - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validation in gdatetimeaddfull - Fix CVE-2026-58012: buffer...

Oracle Linux 9 : glib2 (ELSA-2026-55440)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55440 advisory. - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Fix CVE-2026-58012: buffe...

glib2 security update

2.68.4-19.9 - Fix CVE-2026-15588: limit D-Bus auth line read length 2.68.4-19.8 - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157 2.68.4-19.7 - Fix CVE-2026-58012: buffer overflow in gregex.c with GREGEXRAW - Resolves: RHEL-212217 2.68.4-19.6 - Fix...

Oracle Linux 8 : mingw-glib2 (ELSA-2026-49512)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49512 advisory. - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves:...

MiracleLinux 9 : coreutils-8.32-41.el9_8 (AXSA:2026-1423:04)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1423:04 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly fr...

CLSA-2026-1784203659 Fix CVE(s): CVE-2026-58014, CVE-2026-58015, CVE-2026-58016

SECURITY UPDATE: One-byte heap under-read in GKeyFile locale string list - debian/patches/CVE-2026-58014.patch: guard len 0 before reading valuelen - 1 when a key has an empty value in gkeyfilegetlocalestringlist in glib/gkeyfile.c - CVE-2026-58014 SECURITY UPDATE: Path traversal via unvalidated...

CLSA-2026-1783690752 glib2: Fix of 2 CVEs

CVE-2026-58014: fix one-byte heap under-read in gkeyfilegetlocalestringlist with an empty value - CVE-2026-58015: validate DBUSCOOKIESHA1 cookiecontext to prevent server-controlled path traversal / arbitrary file read...

CLSA-2026-1783671013 glib2: Fix of 2 CVEs

CVE-2026-58014: fix one-byte heap under-read in gkeyfilegetlocalestringlist with an empty value - CVE-2026-58015: validate DBUSCOOKIESHA1 cookiecontext to prevent server-controlled path traversal / arbitrary file read...

CLSA-2026-1783670904 glib2: Fix of 2 CVEs

CVE-2026-58014: fix one-byte heap under-read in gkeyfilegetlocalestringlist with an empty value - CVE-2026-58015: validate DBUSCOOKIESHA1 cookiecontext to prevent server-controlled path traversal / arbitrary file read...

CLSA-2026-1783340758 glib2: Fix of 3 CVEs

CVE-2026-58014: fix one-byte heap under-read in gkeyfilegetlocalestringlist on an empty value - CVE-2026-58015: validate the server-supplied cookiecontext in the DBUSCOOKIESHA1 client to prevent path traversal / arbitrary file read - CVE-2026-58016: fix state-confusion in gdbusnodeinfonewforxml...

CLSA-2026-1783340282 Fix CVE(s): CVE-2026-58014, CVE-2026-58015, CVE-2026-58016

SECURITY UPDATE: state confusion in the D-Bus introspection XML parser - debian/patches/CVE-2026-58016.patch: reject a element nested inside a non- parent in gdbusnodeinfonewforxml - CVE-2026-58016 SECURITY UPDATE: one-byte heap under-read on an empty key-file value -...

CLSA-2026-1783339922 Fix CVE(s): CVE-2026-58014, CVE-2026-58015, CVE-2026-58016

SECURITY UPDATE: state confusion in the D-Bus introspection XML parser - debian/patches/CVE-2026-58016.patch: reject a element nested inside a non- parent in gdbusnodeinfonewforxml - CVE-2026-58016 SECURITY UPDATE: one-byte heap under-read on an empty key-file value -...