Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

PT-2026-90328

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS boot sector processing where MFT and MFTMirr locations, stored as unsigned 64-bit LCNs Logical Cluster Numbers, are incorrectly decoded into signed 64-bit...

PT-2026-96068

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

openSUSE 16: libzypp / libzypp-devel / zypper / zypper-aptitude / zypper-log / etc (openSUSE-SU-2026:21808-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21808-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. Non security issues fixed: - Eco...

PT-2026-90258

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss krb5 unwrap v2 function reads header fields before validating that the token is at least 16 bytes long. This can lead to out-of-boun...

PT-2026-90267

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the SUNRPC component. The xdr buf trim function trims bytes from the tail of an xdr buf by iterating through tail, pages, and head iovecs. A failure to cla...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107274)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107274 advisory. In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9clientwrite and...

CVE-2026-89042

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

EUVD-2026-75631

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-89042

passport-saml-encrypted through version 0.1.13 contains an authentication bypass vulnerability in its SAML signature verification logic. The signature check is conditional on an optional cert option; when this option is not configured, SAML responses are accepted without signature verification . ...

CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

Security update for libzypp, zypper (critical)

openSUSE security update: security update for libzypp, zypper ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21808-1 Rating: critical References: bsc1257249 bsc1271730 bsc1272534 bsc1273242 bsc1274091 bsc1274625 bsc1277790 Affected Products: openSU...

PT-2026-89521

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

Unity Linux 20.1060a Security Update: glib2 (UTSA-2026-071902)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-071902 advisory. A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

CVE-2026-77974

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...

EUVD-2026-75056

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...

CVE-2026-77974

Softish C6 Ear Camera and its EarVision Android Application contain a vulnerability where a critical function lacks proper authentication. After spoofing the device and obtaining a single user confirmation, an attacker in the adjacent network can cause the application to transmit firmware through...

CVE-2026-77974 Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...