CLSA-2026-1791780738 kernel: Fix of 72 CVEs

drm/amd/pm: bound ppdpmsetpptable memcpy CVE-2026-97427 - Bluetooth: L2CAP: validate connectionless PSM length CVE-2026-97408 - ipv6: sr: restore network header before routing and forwarding CVE-2026-98096 - ipv6: fix fib6 walker UAF on seq stop CVE-2026-97940 - net: mpls: clear innerprotocol...

emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image

A flaw was found in GNU Emacs. An integer overflow in the PBM/PPM/PGM image loader allows a remote attacker to leak heap memory contents. By supplying a specially crafted image with large dimensions and an elevated maximum color index, the image loader's internal calculations can wrap to a negati...

emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image

A flaw was found in GNU Emacs. An integer overflow in the PBM/PPM/PGM image loader allows a remote attacker to leak heap memory contents. By supplying a specially crafted image with large dimensions and an elevated maximum color index, the image loader's internal calculations can wrap to a negati...

K000163654: GLib vulnerabilities CVE-2026-1484 and CVE-2026-1489

Security Advisory Description CVE-2026-1484 A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocat...

Important: Red Hat Security Advisory: gimp security update

An update for gimp is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

gimp: GIMP: Remote code execution via PSD file parsing integer overflow

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability within the readchanneldata function during PSD Photoshop Document file parsing by enticing a user to open a specially crafted PSD file. This could lead to arbitrary code execution in the context of the...

gimp: GIMP: Arbitrary code execution via crafted TIF file parsing

A flaw was found in GIMP. This vulnerability allows a remote attacker to execute arbitrary code by tricking a user into opening a specially crafted TIF file. The issue arises from improper validation of user-supplied data during TIF file parsing, which can lead to an integer overflow before memor...

gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow

A flaw was found in GIMP, an image manipulation program. This vulnerability allows a remote attacker to execute arbitrary code on an affected system. Exploitation requires user interaction, where the target must open a specially crafted TIF Tagged Image File Format file. The flaw occurs during TI...

gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow

A flaw was found in GIMP. This vulnerability, an integer overflow within the parsing of SGI Silicon Graphics Image files, allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, where the target must open a specially crafted malicious SGI file. Successful...

gimp: gimp: Integer overflow in read_RLE_channel()

A flaw was found in GIMP's PSD parser. An integer overflow in readRLEchannel can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitra...

gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

ROS-20261012-73-0011

The vulnerability of the cephmonmapdecode function in the net/ceph/monclient.c module, which implements networking functions for the Linux kernel, is related to integer overflow or cyclic shift vulnerabilities. Exploitation of this vulnerability could allow a remote attacker to cause a service...

Important: python-pymongo

Issue Overview: A flaw was found in pymongo. An integer overflow exists in the bundled native extension for Binary JSON BSON document encoding when processing an unusually large amount of data. An unprivileged attacker who can submit oversized data to an application for encoding can trigger an...

Important: perl-Net-IDN-Encode

Issue Overview: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no...

Medium: perl-Storable

Issue Overview: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negati...

Medium: perl

Issue Overview: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk. When such branches are combined into a trie, the delta between the first branch and the shared...

Medium: libsoup

Issue Overview: OOB Read via Integer Overflow on libsoup through libsoup/websocket/soup-websocket-connection.c via processframe leads to Undefined Behavior CVE-2026-0716 The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving...

Medium: perl-Storable

Issue Overview: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negati...

Medium: perl

Issue Overview: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk. When such branches are combined into a trie, the delta between the first branch and the shared...

ROS-20261012-73-0106

The vulnerability of the tbpropertyentryvalid function in the drivers/thunderbolt/property.c module of the Linux kernel’s general support for USB4 and Thunderbolt drivers is related to the possibility of integer overflow. Exploiting this vulnerability could allow an attacker to compromise the...