libarchive security update

An update is available for libarchive. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libarchive programming library can create and read several different...

RLSA-2026:69553 Low: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

DEBIAN-CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

UBUNTU-CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

A flaw was found in FFmpeg. A local attacker can craft a malicious High Efficiency Image File Format HEIF file that, when processed, can cause a signed integer overflow. This overflow allows width and height values to become negative, bypassing internal validity checks. This can lead to data...

EUVD-2026-85311

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg versions before 9.0 are vulnerable to a signed integer overflow in libavformat/mov.c. When processing a crafted HEIF file, the mov_read_ispe() function stores uint32_t width and height values into signed integer fields without bounds checking, causing values exceeding INT_MAX to become neg...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

SUSE-SU-2026:4309-1 Security update for gimp

This update for gimp fixes the following issues: Security issues fixed: - CVE-2026-59088: denial of service via signed integer overflow in FLI file processing bsc1274837. - CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow bsc1274840. - CVE-2026-66757: signed intege...

PT-2026-97338

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0 Description A signed integer overflow exists in libavformat/mov.c. In the mov read ispe function, uint32 t width and height values from a crafted HEIF ispe box are stored in signed int fields without bounds checkin...

RockyLinux 10 : libarchive (RLSA-2026:69553)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69553 advisory. libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header CVE-2026-15028 libarchive: libarchive: Signed Integer...

AlmaLinux 10 : libarchive (ALSA-2026:69553)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69553 advisory. libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header CVE-2026-15028 libarchive: libarchive: Signed Integer...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1

Summary webkit2gtk3-jsc, gstreamer1-plugins-base, libtiff, and giflib are bundled with IBM Optim as part of its base OS image; Eclipse Jetty jetty-io is used for HTTP server infrastructure; Apache ZooKeeper zookeeper is used for distributed coordination; Jackson Core jackson-core is used for JSON...

RHEL 10 : libarchive (RHSA-2026:69553)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69553 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660...

CVE-2026-90435

CVE-2026-90435 is an integer overflow vulnerability in the Linux kernel's RDMA/mlx5 subsystem. The function set_user_buf_size() left-shifts user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers ; a sufficiently large rq.wqe_cnt triggers signed integer overflow (undefined behavior), ...