OPENSUSE-SU-2026:21863-1 Security update for live555

This update for live555 fixes the following issues: Changes in live555: - Update to version 2026.08.25: Fixed a bug in "VorbisAudioRTPSource" that could have caused a malicious SDP description to crash a RTP client. - update to 2026.08.14: Fixed a bug that could cause a problem with subclassed...

OPENSUSE-SU-2026:21866-1 Security update for chirp

This update for chirp fixes the following issues: Changes in chirp: - Update to version 20260911: ftm300d: Experimental Yaesu FTM-300DR driver Update Ukrainian localization ar8200: Fix importing memories with AM mode Unify Baofeng setting descriptions across drivers Add Yaesu FT5D uvb5: Fix Rever...

Security Bulletin: Vulnerabilities in Eclipse affect Tivoli Netcool/OMNIbus

Summary There are vulnerabilities in the Jetty libraries shipped in the MIB Manager application that is a component of Tivoli Netcool/OMNIbus. The Jetty libraries have been removed from the application. Vulnerability Details CVEID:CVE-2026-2332 DESCRIPTION: In Eclipse Jetty, the HTTP/1.1 parser i...

python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers

A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...

python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers

A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...

GHSA-V8PV-4842-X354 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

Summary The OpenTelemetry.Resources.Host NuGet package is affected by an untrusted search path vulnerability on macOS. The host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved through the PATH environment variabl...

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

Summary The OpenTelemetry.Resources.Host NuGet package is affected by an untrusted search path vulnerability on macOS. The host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved through the PATH environment variabl...

Security update for distribution

This update for distribution fixes the following issues: Security issues fixed: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260283. CVE-2026-33540: information disclosure via improper validation of authentication...

SUSE-SU-2026:4212-1 Security update for distribution

This update for distribution fixes the following issues: Security issues fixed: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authenticati...

CVE-2026-90018

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

AZL-101678 CVE-2026-90018 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

DEBIAN-CVE-2026-90018

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

CVE-2026-89955

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

DEBIAN-CVE-2026-89952

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

DEBIAN-CVE-2026-89955

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89952

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

AZL-101202 CVE-2026-89955 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

AZL-101228 CVE-2026-89952 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

CVE-2026-89947

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...

DEBIAN-CVE-2026-89947

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...