Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Handling of Length Parameter Inconsistency (CVE-2025-14847)

Summary There is a vulnerability in MongoDB Server used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-14847. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-14847 DESCRIPTION: Mismatched length fields in Zlib compressed protocol headers may allow a read of...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3190 (ALAS-2026-3190)

The version of thunderbird installed on the remote host is prior to 140.7.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3190 advisory. A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized but allocated memory. This...

Amazon Linux 2023 : jxl-pixbuf-loader, libjxl, libjxl-devel (ALAS2023-2026-1459)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1459 advisory. A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized but allocated memory. This can be done by causing the decoder to reference an outside-image-bound area...

Important: thunderbird

Issue Overview: A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized but allocated memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005658)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005658 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix integer overflow in radeoncsparserinit The type of size is unsigned, if size is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005641)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005641 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix leaking uninitialized memory in fast-commit journal When space at the end of fast-commi...

Important: jpegxl

Issue Overview: A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized but allocated memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating...

Important: firefox

Issue Overview: A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized but allocated memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005630)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005630 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix integer overflow in radeoncsparserinit The type of size is unsigned, if size is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005797)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005797 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005469)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005469 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are...

SUSE SLES15 Security Update : libjxl (SUSE-SU-2026:0648-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0648-1 advisory. - CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory bsc1258090. -...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005596)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005596 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are...

SUSE-SU-2026:20536-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2026-0861: inadequate size check in the memalign suite may result in an integer overflow bsc1256766. - CVE-2026-0915: uninitialized stack buffer used as DNS query name when net==0 in nssdnsgetnetbyaddrr bsc1256822. - CVE-2025-15281:...

OESA-2026-1485 gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing...

OESA-2026-1484 gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing...

MiracleLinux 9 : nodejs:20 (AXSA:2026-220:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-220:01 advisory. nodejs: Nodejs filesystem permissions bypass CVE-2025-55132 nodejs: Nodejs denial of service CVE-2026-21637 nodejs: Nodejs denial of service...

SUSE-SU-2026:20527-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2026-0861: inadequate size check in the memalign suite may result in an integer overflow bsc1256766. - CVE-2026-0915: uninitialized stack buffer used as DNS query name when net==0 in nssdnsgetnetbyaddrr bsc1256822. - CVE-2025-15281:...

CVE-2026-25941 FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory...

Security update for libjxl

This update for libjxl fixes the following issues: CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory bsc1258090. CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memor...