Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: protobuf-c (UTSA-2023-001305)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001305 advisory. protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. Tenable has extracted the preceding description block directly from the Unity Linux...

SUSE CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

SUSE SLED15: libzypp / libzypp-devel / zypper / zypper-log / etc (SUSE-SU-2026:4092-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4092-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625....

SUSE CVE-2026-44235

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

CVE-2026-61720 FluidSynth: SF2 DMOD Chunk Unsigned Underflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the...

CVE-2026-61720 FluidSynth: SF2 DMOD Chunk Unsigned Underflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the...

CVE-2026-61720

FluidSynth, a software synthesizer based on the SoundFont 2 specification, is affected by an unsigned integer underflow in its SF2 parser's DMOD chunk handler. When a crafted SF2 file contains a zero-sized DMOD chunk, the expression chunk.size / SF_MOD_SIZE - 1 causes the unsigned subtraction to ...

CVE-2026-61720 FluidSynth: SF2 DMOD Chunk Unsigned Underflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the...

gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

SUSE CVE-2026-90136

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Reject negative power cap writes in hwmon hsmphwmonwrite takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATTPERMILLIWATT" to msg.args0, which is a u32. MICROWATTPERMILLIWATT is...

CVE-2026-93019: Unsigned to Signed Conversion Error

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread casts that value to sizet and asks...

CVE-2026-44235

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

CVE-2026-90114

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

DEBIAN-CVE-2026-90114

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

EUVD-2026-82333

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

Summary A logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service Qos configuration method. The Qos function accepts signed integers int for the prefetchCount and prefetchSize parameters but casts them directly to unsigned integers uint16 and uint32, respectivel...

GHSA-RM6M-HRCW-JW33 RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

Summary A logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service Qos configuration method. The Qos function accepts signed integers int for the prefetchCount and prefetchSize parameters but casts them directly to unsigned integers uint16 and uint32, respectivel...

CVE-2026-90114 net: bridge: Reject descending VLAN tunnel ranges

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

EUVD-2026-81707

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...