USN-8704-1 cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3883 (ALAS-2026-3883)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3883 advisory. Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a...

Security update for rav1e (low)

openSUSE security update: security update for rav1e ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21681-1 Rating: low References: bsc1249016 Cross-References: CVE-2025-58160 CVSS scores: CVE-2025-58160 SUSE : 3.1...

Important: vim

Issue Overview: Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars array with no upper boun...

OPENSUSE-SU-2026:21689-1 Security update for gstreamer-devtools

This update for gstreamer-devtools fixes the following issues: - CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption bsc1243178. - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI...

SUSE-SU-2026:23572-1 Security update for gstreamer-devtools

This update for gstreamer-devtools fixes the following issues: - CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption bsc1243178. - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI...

OPENSUSE-SU-2026:21681-1 Security update for rav1e

This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation bsc1249016. Changes for rav1e: - Update cargo dependencies...

SUSE-SU-2026:23567-1 Security update for rav1e

This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation bsc1249016. Changes for rav1e: - Update cargo dependencies...

OESA-2026-3540 cpio security update

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fixes: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio...

SUSE-SU-2026:23355-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

The vulnerability in the progs/infocmp.c component of the input/output library for the Ncurses terminal allows a hacker to cause a service failure.

The vulnerability in the progs/infocmp.c component of the input/output library for the Ncurses terminal emulator is related to buffer overflow on the stack. Exploiting this vulnerability could allow an attacker to cause a service failure...

PYSEC-2026-3774

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

PYSEC-2026-3960

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

PYSEC-2026-3774

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

PYSEC-2026-3775

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

PYSEC-2026-3775

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

PYSEC-2026-3960

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81696

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81695

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81694

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...