SUSE SLES12 Security Update : pam (SUSE-SU-2026:3162-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3162-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

SUSE SLED15: pam / pam-32bit / pam-devel / pam-devel-32bit / pam-doc / pam-extra / etc (SUSE-SU-2026:3163-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3163-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the Track::initsampletimingtable process. An attacker can trigger a heap buffer overflow by providing a crafted file where the number of chunks defined in the stco box is less than the number of samples in stsz,...

CVE-2026-63937

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV. This time-of-check to time-of-use TOCTOU vulnerability exists when KVM processes the guest-accessible Page State Change PSC buffer. A misbehaving guest could exploit this timing issue...

CVE-2026-47254 libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

EUVD-2026-46436

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

CVE-2026-47254

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

CVE-2026-47254 libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

CVE-2026-15432

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...

EUVD-2026-46318

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...

CVE-2026-15432 Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...

CVE-2026-15432

The CVE concerns Tink-Java and Tink-Android’s ChunkedMacVerification: during tag verification, the implementation uses a non-constant-time comparison, enabling a timing side-channel that could reveal how many bytes of a given tag match the correct tag. This is described as a potential pathway for...

Security update for pam

This update for pam fixes the following issue CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

SUSE-SU-2026:3163-1 Security update for pam

This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

Security update for pam

This update for pam fixes the following issue CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

SUSE-SU-2026:3162-1 Security update for pam

This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

SUSE CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of...

SUSE CVE-2026-64091

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...

Important: Red Hat Security Advisory: postgresql:13 security update

An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...