Principal · Últimas noticias de seguridad

https://security-tracker.debian.org/tracker/DSA-6484-1

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - OCFS2 file system; - SCTP protocol; (CVE-2026-53043, …

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - NVIDIA Tegra memory controller driver; - File systems…

https://security-tracker.debian.org/tracker/DSA-6483-1

It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line, making them visible to other local users through the process list. An attacker could possibly use this to obtain sensitive credentials.…

Targeted Security Release For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

Maintenance and security updates We released updated packages for EasyApache 4. This release patches ea-openssl11 on CentOS 7 for a heap buffer overflow in CMS key unwrapping (CVE-2026-63072) and excessive memory use when buffering DTLS re…

It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks.

It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, result…

It was discovered that libssh2 incorrectly handled certain SFTP server responses. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code. (CVE-2026-66032) It was disco…

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-49506) It was discovered that APR-ut…

It was discovered that OpenSSH's ssh-agent incorrectly handled interactions between agent locking and the session-bind@openssh.com extension. A remote attacker with access to a forwarded agent connection could possibly use this issue to pe…

It was discovered that SSSD did not properly validate authentication token lengths when processing PAM responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a denial of service.

It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-64830) It was discov…

It was discovered that Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who could place files in a directory that Tika subsequently parses could use this issue to read arbitrary files accessible to the Ti…

https://security-tracker.debian.org/tracker/DSA-6482-1

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate att…

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate att…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - OCFS2 file system; - SCTP protocol; (CVE-2026-53043, …

Mark Bereza and Lilith Wyatt discovered that BioSig incorrectly handled certain crafted input files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-22891, CVE-2026-20777)

https://security-tracker.debian.org/tracker/DSA-6481-1

It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume…

It was discovered that Libgcrypt had a timing-based side-channel flaw in its RSA implementation. A remote attacker could possibly use this issue to obtain sensitive information.

USN-8688-1 fixed a vulnerability in PAM. This update provides the corresponding fix for PAM on Ubuntu 26.04 LTS. Original advisory details: Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records wh…

USN-8555-1 fixed vulnerabilities in Ubuntu Advantage Tools. On Ubuntu 14.04 LTS only, it was discovered that some machines were unable to enable esm-infra-legacy due to a preemptive apt-helper check. This update fixes the problem. We apol…

Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue onl…

It was discovered that ncurses incorrectly handled specially crafted terminfo database entries. A local attacker could possibly use this issue to cause applications using ncurses to crash, resulting in a denial of service.

It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, a…

It was discovered that Pillow did not properly manage memory when processing certain image files. An attacker could possibly use this issue to cause a denial of service or read sensitive data.

https://security-tracker.debian.org/tracker/DSA-6480-1

USN-8705-1 fixed vulnerabilities in OpenZFS. This update provides the corresponding fix for OpenZFS on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenZFS incorrectly handled authorization che…

It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a denial of service via excessive CPU consumption.

It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. (CVE-2026-40253) It was discovered that open…

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use th…

It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resul…