Aggregator | Linuxlookup

It was discovered that Beets incorrectly escaped untrusted media metadata in its web interface. An attacker could possibly use this issue to inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser.

USN-8746-1: libEBML vulnerability

Ubuntu Security Advisories

8 hours 5 minutes ago

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service.

USN-8745-1: KissFFT vulnerabilities

Ubuntu Security Advisories

8 hours 17 minutes ago

It was discovered that KissFFT incorrectly handled certain large Fourier transform sizes on 32-bit architectures. An attacker could possibly use this issue to cause KissFFT to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2025-34297) It was discovered that KissFFT incorrectly handled certain multidimensional Fourier transform sizes. An attacker could possibly use this issue to cause KissFFT to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-41445)

USN-8748-1: Linux kernel (NVIDIA) vulnerabilities

Ubuntu Security Advisories

8 hours 21 minutes ago

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - GFS2 file system; - OCFS2 file system; - SMB network file system; - B.A.T.M.A.N. meshing protocol; - Ceph Core library; - IPv4 networking; - IPv6 networking; - Netfilter; - Open vSwitch; - RxRPC session sockets; - SCTP protocol; - TIPC protocol; (CVE-2026-52914, CVE-2026-52931, CVE-2026-52955, CVE-2026-52958, CVE-2026-52982, CVE-2026-52986, CVE-2026-52993, CVE-2026-52999, CVE-2026-53002, CVE-2026-53006, CVE-2026-53010, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53049, CVE-2026-53055, CVE-2026-53088, CVE-2026-53151, CVE-2026-53175, CVE-2026-53215, CVE-2026-53216, CVE-2026-53224, CVE-2026-53246, CVE-2026-53247, CVE-2026-53260, CVE-2026-53309, CVE-2026-64531)

openssl3-3.5.8-1.fc45

Fedora Security Advisories

9 hours 16 minutes ago

FEDORA-2026-9e18ff28a6 Packages in this update:

openssl3-3.5.8-1.fc45

Update description:

Rebase to OpenSSL 3.5.8

USN-8744-1: Python vulnerabilities

Ubuntu Security Advisories

10 hours 1 minute ago

It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644) It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224) It was discovered that Python's tarfile module did not correctly apply the filter parameter when extracting hard links. An attacker could possibly use this issue to cause files to be extracted with an unexpected uid or gid, bypassing the restrictions requested via filter='data'. (CVE-2026-4360) It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method. An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019) It was discovered that Python's html.parser module incorrectly handled repeated unterminated markup declarations. An attacker could possibly use this issue to cause Python to consume excessive CPU resources, leading to a denial of service. (CVE-2026-15308)

USN-8743-1: PHP vulnerabilities

Ubuntu Security Advisories

12 hours 6 minutes ago

It was discovered that PHP incorrectly handled backslash escaping in the PostgreSQL extension. An attacker could use this issue to perform SQL injection attacks. (CVE-2026-17543) It was discovered that PHP incorrectly handled certain inputs to the bccomp() function. An attacker could use this issue to cause an out-of- bounds write, resulting in a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-17544) It was discovered that PHP incorrectly handled circular symbolic links in phar archives. An attacker could use this issue to cause unbounded recursion, resulting in a denial of service. (CVE-2026-7260)

USN-8737-2: GNU C Library vulnerabilities

Ubuntu Security Advisories

12 hours 29 minutes ago

USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides the corresponding fixes for Ubuntu 24.04 LTS. Original advisory details: It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right-justification padding. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499) It was discovered that GNU C Library had an out-of-bounds stack array access in the tdelete function. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-19542) It was discovered that GNU C Library incorrectly handled memory when calling wordexp with the WRDE_APPEND flag. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-6368) It was discovered that GNU C Library had a stack overflow in the wordexp function when expanding paths beginning with a tilde followed by a long username. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-6791) It was discovered that GNU C Library had a hang in the SHIFT_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-77117) It was discovered that GNU C Library had a hang in the EUC_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-80489)