71 matches found
CVE-2026-92824 affecting package libmodulemd for versions less than 2.15.4-1
CVE-2026-92824 affecting package libmodulemd for versions less than 2.15.4-1. An upgraded version of the package is available that resolves this issue...
OESA-2026-4819 libmodulemd security update
The libmodulemd API provides a number of convenience tools for interacting with repodata that is, streams of YAML that contains information on multiple streams, default data and translations. Security Fixes: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted...
OESA-2026-4818 libmodulemd security update
The libmodulemd API provides a number of convenience tools for interacting with repodata that is, streams of YAML that contains information on multiple streams, default data and translations. Security Fixes: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted...
OESA-2026-4816 libmodulemd security update
The libmodulemd API provides a number of convenience tools for interacting with repodata that is, streams of YAML that contains information on multiple streams, default data and translations. Security Fixes: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted...
OESA-2026-4817 libmodulemd security update
The libmodulemd API provides a number of convenience tools for interacting with repodata that is, streams of YAML that contains information on multiple streams, default data and translations. Security Fixes: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted...
[SECURITY] Fedora 44 Update: libmodulemd-2.15.4-1.fc44
C library for manipulating module metadata files. See https://github.com/fedora-modularity/libmodulemd/blob/main/README.md for more details...
[SECURITY] Fedora 45 Update: libmodulemd-2.15.4-1.fc45
C library for manipulating module metadata files. See https://github.com/fedora-modularity/libmodulemd/blob/main/README.md for more details...
Fedora 45 : libmodulemd (2026-946f33e2c8)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-946f33e2c8 advisory. This release rejects YAML files which decompress to much CVE-2026-92823, rejects YAML documents with YAML tree deeper than 64 CVE-2026-92822, fixes...
Fedora 44 : libmodulemd (2026-d657495ea3)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d657495ea3 advisory. This release rejects YAML files which decompress to much CVE-2026-92823, rejects YAML documents with YAML tree deeper than 64 CVE-2026-92822, fixes...
libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed YAML
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libmodulemd: libmodulemd-2.15.4-1.hum1 aarch64, s390x, x8664 libmodulemd-devel-2.15.4-1.hum1 aarch64, s390x, x8664 python3-libmodulemd-2.15.4-1.hum1 aarch64, s390x, x8664...
libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd YAML
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content...
libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an...
UBUNTU-CVE-2026-92823
A flaw was found in libmodulemd. In builds with rpmio support enabled,...
SUSE CVE-2026-92822
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content...
SUSE CVE-2026-92823
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...
SUSE CVE-2026-92824
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an...
CVE-2026-92823
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...
DEBIAN-CVE-2026-92824
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an...
CVE-2026-92824
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an...