Aggregator | Linuxlookup

It was discovered that PostgreSQL did not correctly enforce authorization for CREATE TYPE. An attacker could possibly use this issue to execute arbitrary SQL functions. (CVE-2026-6472) It was discovered that PostgreSQL incorrectly handled large user input in multiple server features. An attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-6473) It was discovered that PostgreSQL incorrectly handled format strings in the timeofday() function. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-6474) It was discovered that PostgreSQL incorrectly followed symbolic links in pg_basebackup and pg_rewind. An attacker could possibly use this issue to overwrite local files and execute arbitrary code. (CVE-2026-6475) It was discovered that PostgreSQL had an SQL injection vulnerability in pg_createsubscriber. An attacker could possibly use this issue to execute arbitrary SQL as a superuser. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-6476) It was discovered that PostgreSQL used an unsafe libpq function in large object operations. An attacker could possibly use this issue to overwrite client memory and execute arbitrary code. (CVE-2026-6477) It was discovered that PostgreSQL did not compare MD5-hashed passwords in constant time. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-6478) It was discovered that PostgreSQL had uncontrolled recursion during SSL and GSS negotiation. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-6479) It was discovered that PostgreSQL incorrectly handled array length mismatches in pg_restore_attribute_stats(). An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-6575) It was discovered that PostgreSQL had a stack buffer overflow in the refint module. An attacker could use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-6637) It was discovered that PostgreSQL had an SQL injection vulnerability in logical replication REFRESH PUBLICATION. An attacker could possibly use this issue to execute arbitrary SQL. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-6638)

kernel-6.19.14-108.fc42

Fedora Security Advisories

5 hours 34 minutes ago

FEDORA-2026-b9f338a467 Packages in this update:

kernel-6.19.14-108.fc42

Update description:

The 6.19.14-108 stable kernel update contains a couple if important security fixes.

xrdp-0.10.6-2.fc44

Fedora Security Advisories

5 hours 42 minutes ago

FEDORA-2026-9a3a98bc24 Packages in this update:

xrdp-0.10.6-2.fc44

Update description:

Close TCP socket in default configuration, because we want just Unix domain socket connections to Xvnc.

xrdp-0.10.6-2.fc42

Fedora Security Advisories

5 hours 42 minutes ago

FEDORA-2026-6af8517b94 Packages in this update:

xrdp-0.10.6-2.fc42

Update description:

Close TCP socket in default configuration, because we want just Unix domain socket connections to Xvnc.

xrdp-0.10.6-2.el9

Fedora Security Advisories

5 hours 42 minutes ago

FEDORA-EPEL-2026-8d69cba26b Packages in this update:

xrdp-0.10.6-2.el9

Update description:

Close TCP socket in default configuration, because we want just Unix domain socket connections to Xvnc.

xrdp-0.10.6-2.fc43

Fedora Security Advisories

5 hours 42 minutes ago

FEDORA-2026-8aeca78af9 Packages in this update:

xrdp-0.10.6-2.fc43

Update description:

Close TCP socket in default configuration, because we want just Unix domain socket connections to Xvnc.

xrdp-0.10.6-2.el8

Fedora Security Advisories

5 hours 42 minutes ago

FEDORA-EPEL-2026-cf191f562d Packages in this update:

xrdp-0.10.6-2.el8

Update description:

Close TCP socket in default configuration, because we want just Unix domain socket connections to Xvnc.

haveged-1.9.22-1.fc43

Fedora Security Advisories

5 hours 44 minutes ago

FEDORA-2026-5d9b0e2c17 Packages in this update:

haveged-1.9.22-1.fc43

Update description:

Update to 1.9.22 — fix systemd sandboxing: add ReadWritePaths=/dev/shm for semaphore creation

Backport fix for CVE-2026-41054: privilege escalation via command socket

haveged-1.9.22-1.fc42

Fedora Security Advisories

5 hours 44 minutes ago

FEDORA-2026-8fa79f47e1 Packages in this update:

haveged-1.9.22-1.fc42

Update description:

Update to 1.9.22 — fix systemd sandboxing: add ReadWritePaths=/dev/shm for semaphore creation

Backport fix for CVE-2026-41054: privilege escalation via command socket

USN-8293-1: Bind vulnerabilities

Ubuntu Security Advisories

6 hours 36 minutes ago

Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. (CVE-2026-3039) Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue records. A remote attacker could possibly use this issue to use Bind in denial of service amplification attacks against other systems. (CVE-2026-3592) Naresh Kandula Parmar discovered that Bind incorrectly handled memory in the DNS-over-HTTPS implementation. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-3593) It was discovered that Bind incorrectly handled DNS messages whose class was not IN. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-5946) Naoki Wakamatsu discovered that Bind incorrectly handled SIG(0) validation during a query flood. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-5947) Billy Baraja discovered that Bind had an unbounded resend loop in the resolver. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. (CVE-2026-5950)