MGASA-2026-0417 Updated gdk-pixbuf2.0 packages fix security vulnerabilities

Heap‑buffer‑overflow in gdk‑pixbuf. CVE-2025-7345 Out-of-bounds read in ico parser. CVE-2026-16768 Invalid write in jpeg icc profile parser on error recovery. CVE-2026-81893...

Updated gdk-pixbuf2.0 packages fix security vulnerabilities

Heap‑buffer‑overflow in gdk‑pixbuf. CVE-2025-7345 Out-of-bounds read in ico parser. CVE-2026-16768 Invalid write in jpeg icc profile parser on error recovery. CVE-2026-81893...

SUSE CVE-2026-93435

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

CVE-2026-77396

The PJSIP multimedia communication library (version 2.17 and earlier ) contains a heap-based buffer overflow in the AVI parser located at pjmedia/src/pjmedia/avi_player.c. The vulnerability occurs because the parser uses an input-file video chunk length to copy bytes into a frame buffer whose cap...

CVE-2026-77396 PJSIP: Heap buffer overflow in the AVI parser

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...

CVE-2026-77396 PJSIP: Heap buffer overflow in the AVI parser

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...

EUVD-2026-83196

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...

CVE-2026-77396 PJSIP: Heap buffer overflow in the AVI parser

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...

CVE-2026-77396

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...

CVE-2026-59156 OpenImageIO: Unbounded recursion in FITS header parser leads to stack overflow

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes...

Security Bulletin: IBM App Connect Enterprise is vulnerable to XML Entity Expansion due to Node.js module fast-xml-parser (CVE-2026-73569)

Summary IBM App Connect Enterprise runtime is vulnerable to XML Entity Expansion due to Node.js module fast-xml-parser. Vulnerability Details CVEID:CVE-2026-73569 DESCRIPTION: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until...

aprsd (>=1.5.0, <=1.5.1), ttp-sros-parser (>=0.0.1, <=0.1.4) potentially affected by CVE-2026-102930 via virtualenv (20.2.2)

virtualenv PYPI version 20.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aprsd =1.5.0, =0.0.1, =0.1.4 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

EUVD-2026-82533

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

SUSE CVE-2026-90112

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

SUSE CVE-2026-90143

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

PT-2026-95551

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.18 Description The AVI parser in pjmedia/src/pjmedia/avi player.c uses a video chunk length from an input file to determine the number of bytes copied into a frame buffer. Because the buffer capacity is based on...

Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the MnTRESTLivelogService class. Due to the improper restriction of X...

CVE-2026-77396: Heap-based Buffer Overflow

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...

CVE-2026-63448: Uncontrolled Resource Consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, becaus...

CVE-2026-61722: Integer Overflow or Wraparound

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS...