Aggregator | Linuxlookup

It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line, making them visible to other local users through the process list. An attacker could possibly use this to obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789) It was discovered that rabbitmq-c did not correctly compute AMQP frame lengths, leading to a size_t underflow. A remote attacker could possibly use this to cause rabbitmq-c to crash, resulting in a denial of service, or possibly expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44235) It was discovered that rabbitmq-c did not properly validate the frame size during the AMQP login handshake. A remote attacker could possibly use this to cause a heap buffer overflow, resulting in a denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44236) It was discovered that rabbitmq-c did not correctly validate the length of decoded bytes fields, leading to an integer overflow in a bounds check on 32-bit systems. A remote attacker controlling a broker, or able to intercept an unencrypted connection, could possibly use this to cause an out-of-bounds read, resulting in a denial of service or the exposure of sensitive information. (CVE-2026-59986) It was discovered that rabbitmq-c did not validate the body fragment length when serialising an AMQP body frame with the amqp_send_frame() API. An attacker could possibly use this to cause a heap buffer overflow, resulting in a denial of service (application crash) or possibly the execution of arbitrary code. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61547)

mingw-expat-2.8.4-1.fc44

Fedora Security Advisories

1 week ago

FEDORA-2026-5660612c34 Packages in this update:

mingw-expat-2.8.4-1.fc44

Update description:

Update to expat-2.8.4.

mingw-expat-2.8.4-1.fc43

Fedora Security Advisories

1 week ago

FEDORA-2026-4a2ee61320 Packages in this update:

mingw-expat-2.8.4-1.fc43

Update description:

Update to expat-2.8.4.

mingw-expat-2.8.4-1.fc45

Fedora Security Advisories

1 week ago

FEDORA-2026-9e9244744d Packages in this update:

mingw-expat-2.8.4-1.fc45

Update description:

Update to expat-2.8.4.

nagios-plugins-2.5-2.el9

Fedora Security Advisories

1 week ago

FEDORA-EPEL-2026-b3ba209e5d Packages in this update:

nagios-plugins-2.5-2.el9

Update description:

Update to upstream (bz#2453492). check_icmp: host-count overflow leads to heap buffer overflow (bz#2513957) Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase hostnames (bz#2500542) Added perl-Math-BigInt as dependency for nagios-plugins-ssl_validity (bz#2439960)

USN-8720-1: GnuPG vulnerability

Ubuntu Security Advisories

1 week ago

It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks.

USN-8723-1: SPICE vdagent vulnerabilities

Ubuntu Security Advisories

1 week ago

It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. (CVE-2026-57965) It was discovered that SPICE vdagent did not properly sanitize filenames provided by the SPICE host during file transfers. A malicious or compromised SPICE host could possibly use this issue to write arbitrary files to any location on the guest operating system with the privileges of the spice-vdagent process. (CVE-2026-57966)

USN-8722-1: libssh2 vulnerabilities

Ubuntu Security Advisories

1 week ago

It was discovered that libssh2 incorrectly handled certain SFTP server responses. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code. (CVE-2026-66032) It was discovered that libssh2 incorrectly handled AES-GCM cipher negotiation. A remote attacker controlling an SSH server could possibly use this issue to cause libssh2 to crash, resulting in a denial of service. (CVE-2026-66033) It was discovered that libssh2 incorrectly handled Encrypt-then-MAC cipher negotiation. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code. (CVE-2026-66035)

USN-8719-1: APR-util vulnerabilities

Ubuntu Security Advisories

1 week ago

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-49506) It was discovered that APR-util incorrectly handled recursive XML element quoting. An attacker could possibly use this issue to cause applications using APR-util to crash, resulting in a denial of service. (CVE-2026-32327) It was discovered that the APR-util Redis client incorrectly handled certain network data, resulting in a heap-based buffer overflow. A remote attacker could possibly use this issue to cause APR-util applications to crash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-34501) It was discovered that the APR-util memcached client incorrectly handled certain network data, resulting in a heap-based buffer overflow. A remote attacker could possibly use this issue to cause APR-util applications to crash or execute arbitrary code. (CVE-2026-34502)

USN-8721-1: OpenSSH vulnerabilities

Ubuntu Security Advisories

1 week ago

It was discovered that OpenSSH's ssh-agent incorrectly handled interactions between agent locking and the session-bind@openssh.com extension. A remote attacker with access to a forwarded agent connection could possibly use this issue to perform operations that should only be available locally, such as adding tokens or using keys. (CVE-2026-73281) It was discovered that OpenSSH's ssh client incorrectly handled concurrent remote-forwarding operations. A remote attacker could possibly use this issue to cause a use-after-free condition, resulting in a denial of service or the execution of arbitrary code. (CVE-2026-73282) It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to bypass intended tunnel forwarding restrictions. (CVE-2026-73283)

nagios-plugins-2.5-2.el10_4

Fedora Security Advisories

1 week ago

FEDORA-EPEL-2026-df80b78e8b Packages in this update:

nagios-plugins-2.5-2.el10_4

Update description:

Update to upstream (bz#2453492). check_icmp: host-count overflow leads to heap buffer overflow (bz#2513957) Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase hostnames (bz#2500542) Added perl-Math-BigInt as dependency for nagios-plugins-ssl_validity (bz#2439960)