26 matches found
openSUSE 16: gnome-extensions / gnome-shell / gnome-shell-calendar / etc (openSUSE-SU-2026:21976-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21976-1 advisory. This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provide...
SUSE SLES16: gnome-extensions / gnome-shell / gnome-shell-devel / etc (SUSE-SU-2026:23950-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:23950-1 advisory. This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote...
SUSE-SU-2026:23950-1 Security update for gnome-shell
This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619...
OPENSUSE-SU-2026:21976-1 Security update for gnome-shell
This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619...
SUSE-SU-2026:4373-1 Security update for gnome-shell
This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619...
SUSE SLES12: gnome-shell / gnome-shell-browser-plugin / gnome-shell-devel / etc (SUSE-SU-2026:4350-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4350-1 advisory. This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote...
Security update for gnome-shell
This update for gnome-shell fixes the following issue: CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619. Patch Instructions: To install this SUSE update use the SUSE recommended installation...
SUSE-SU-2026:4350-1 Security update for gnome-shell
This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619...
SUSE CVE-2026-91786
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...
CVE-2026-91786
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...
CVE-2026-91786 Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...
CVE-2026-91786
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...
CVE-2026-91786: Out-of-bounds Read
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...
PT-2026-91926
Name of the Vulnerable Software and Affected Versions GNOME Shell affected versions not specified Description An issue exists when processing icons from a remote search provider via D-Bus. The system does not validate the declared dimensions of the icon against the actual data buffer size. A...
CVE-2026-71246
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
CVE-2026-71246 Pixelfed - Authenticated SSRF via Remote URL Search
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
CVE-2026-71246
Pixelfed’s Pixelfed SearchController (behind auth) is vulnerable to an authenticated SSRF via remote URL search. The vulnerable path takes a URL from remote-search parameters and fetches it server-side using ActivityPubFetchService. The validateUrl() logic only blocks literal hosts 127.0.0.1, loc...
CVE-2026-71246 Pixelfed - Authenticated SSRF via Remote URL Search
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
CVE-2026-71246
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
EUVD-2026-53319
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...