{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat Enterprise Linux 10: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--red-hat-enterprise-linux-10/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--red-hat-enterprise-linux-10/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115486/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115486/",
   "title": "CVE-2026-115486 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.",
   "date_published": "2026-10-23T00:16:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115484/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115484/",
   "title": "CVE-2026-115484 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.",
   "date_published": "2026-10-23T00:16:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111079/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111079/",
   "title": "CVE-2026-111079 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.",
   "date_published": "2026-10-22T10:18:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112177/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112177/",
   "title": "CVE-2026-112177 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.",
   "date_published": "2026-10-20T07:25:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112261/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112261/",
   "title": "CVE-2026-112261 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.",
   "date_published": "2026-10-19T21:37:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112258/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112258/",
   "title": "CVE-2026-112258 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.",
   "date_published": "2026-10-19T21:37:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112257/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112257/",
   "title": "CVE-2026-112257 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.",
   "date_published": "2026-10-19T21:37:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112260/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112260/",
   "title": "CVE-2026-112260 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.",
   "date_published": "2026-10-19T19:24:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16460/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16460/",
   "title": "CVE-2026-16460 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.",
   "date_published": "2026-10-19T06:40:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-62439/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-62439/",
   "title": "CVE-2026-62439 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.",
   "date_published": "2026-10-16T21:54:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-62439/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-62439/",
   "title": "CVE-2026-62439 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (gimp 3.2.6-1)",
   "content_text": "Fixed versions: gimp 3.2.6-1.",
   "date_published": "2026-10-16T21:54:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.21 (cifs-utils 7.1-r1)",
   "content_text": "Fixed versions: cifs-utils 7.1-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.22 (cifs-utils 7.3-r1)",
   "content_text": "Fixed versions: cifs-utils 7.3-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.23 (cifs-utils 7.4-r1)",
   "content_text": "Fixed versions: cifs-utils 7.4-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.24 (cifs-utils 7.5-r1)",
   "content_text": "Fixed versions: cifs-utils 7.5-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2 (cifs-utils 6.2-10.amzn2.0.5 and 1 more)",
   "content_text": "Fixed versions: cifs-utils 6.2-10.amzn2.0.5, cifs-utils-devel 6.2-10.amzn2.0.5.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2023 (cifs-utils 7.7-145.amzn2023.0.1 and 3 more)",
   "content_text": "Fixed versions: cifs-utils 7.7-145.amzn2023.0.1, cifs-utils-devel 7.7-145.amzn2023.0.1, cifs-utils-info 7.7-145.amzn2023.0.1, pam_cifscreds 7.7-145.amzn2023.0.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Debian 13 (cifs-utils 2:7.4-1+deb13u1)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1+deb13u1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (cifs-utils 2:7.9-1)",
   "content_text": "Fixed versions: cifs-utils 2:7.9-1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.3 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.4 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.5 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Basesystem 15 SP7 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-12-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 12 SP5-LTSS (cifs-utils 6.9-13.32.2)",
   "content_text": "Fixed versions: cifs-utils 6.9-13.32.2.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP4-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP5-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP6-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP4 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP5 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP6 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-ltss-extended-security-12-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 (cifs-utils 6.9-13.32.2)",
   "content_text": "Fixed versions: cifs-utils 6.9-13.32.2.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 22.04 LTS (cifs-utils 2:6.14-1ubuntu0.7)",
   "content_text": "Fixed versions: cifs-utils 2:6.14-1ubuntu0.7.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 24.04 LTS (cifs-utils 2:7.0-2ubuntu0.6)",
   "content_text": "Fixed versions: cifs-utils 2:7.0-2ubuntu0.6.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 26.04 LTS (cifs-utils 2:7.4-1ubuntu0.26.04.4)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1ubuntu0.26.04.4.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 26.10 (cifs-utils 2:7.4-1ubuntu3.1)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1ubuntu3.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86565/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86565/",
   "title": "CVE-2026-86565 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.",
   "date_published": "2026-10-14T16:08:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86565/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86565/",
   "title": "CVE-2026-86565 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:08:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86565/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86565/",
   "title": "CVE-2026-86565 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:08:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86563/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86563/",
   "title": "CVE-2026-86563 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.",
   "date_published": "2026-10-14T16:08:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86563/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86563/",
   "title": "CVE-2026-86563 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:08:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86563/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86563/",
   "title": "CVE-2026-86563 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:08:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86562/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86562/",
   "title": "CVE-2026-86562 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.",
   "date_published": "2026-10-14T16:07:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86562/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86562/",
   "title": "CVE-2026-86562 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:07:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86562/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86562/",
   "title": "CVE-2026-86562 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:07:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86476/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86476/",
   "title": "CVE-2026-86476 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.",
   "date_published": "2026-10-14T10:00:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109832/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109832/",
   "title": "CVE-2026-109832 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.",
   "date_published": "2026-10-13T11:36:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-108094/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-108094/",
   "title": "CVE-2026-108094 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.",
   "date_published": "2026-10-12T14:43:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-108094/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-108094/",
   "title": "CVE-2026-108094 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (mutter 50.5-1)",
   "content_text": "Fixed versions: mutter 50.5-1.",
   "date_published": "2026-10-12T14:43:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107935/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107935/",
   "title": "CVE-2026-107935 · Red Hat Build of Podman Desktop · disclosed",
   "content_text": "A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.",
   "date_published": "2026-10-09T09:05:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89091/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89091/",
   "title": "CVE-2026-89091 · Red Hat Migration Toolkit for Applications 8 · disclosed",
   "content_text": "A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.",
   "date_published": "2026-10-08T21:49:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89091/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89091/",
   "title": "CVE-2026-89091 · Red Hat Migration Toolkit for Applications 8 · fixed in openSUSE Tumbleweed (ansible-core 2.21.5-2.1 and 3 more)",
   "content_text": "Fixed versions: ansible-core 2.21.5-2.1, ansible-core-2.18 2.18.19-3.1, ansible-core-2.19 2.19.14-2.1, ansible-core-2.20 2.20.10-2.1.",
   "date_published": "2026-10-08T21:49:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2 (cyrus-sasl 2.1.26-24.amzn2.0.2 and 10 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.26-24.amzn2.0.2, cyrus-sasl-devel 2.1.26-24.amzn2.0.2, cyrus-sasl-gs2 2.1.26-24.amzn2.0.2, cyrus-sasl-gssapi 2.1.26-24.amzn2.0.2, cyrus-sasl-ldap 2.1.26-24.amzn2.0.2, cyrus-sasl-lib 2.1.26-24.amzn2.0.2, cyrus-sasl-md5 2.1.26-24.amzn2.0.2, cyrus-sasl-ntlm 2.1.26-24.amzn2.0.2, cyrus-sasl-plain 2.1.26-24.amzn2.0.2, cyrus-sasl-scram 2.1.26-24.amzn2.0.2, cyrus-sasl-sql 2.1.26-24.amzn2.0.2.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2023 (cyrus-sasl 2.1.27-18.amzn2023.0.4 and 10 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.27-18.amzn2023.0.4, cyrus-sasl-devel 2.1.27-18.amzn2023.0.4, cyrus-sasl-gs2 2.1.27-18.amzn2023.0.4, cyrus-sasl-gssapi 2.1.27-18.amzn2023.0.4, cyrus-sasl-ldap 2.1.27-18.amzn2023.0.4, cyrus-sasl-lib 2.1.27-18.amzn2023.0.4, cyrus-sasl-md5 2.1.27-18.amzn2023.0.4, cyrus-sasl-ntlm 2.1.27-18.amzn2023.0.4, cyrus-sasl-plain 2.1.27-18.amzn2023.0.4, cyrus-sasl-scram 2.1.27-18.amzn2023.0.4, cyrus-sasl-sql 2.1.27-18.amzn2023.0.4.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (cyrus-sasl2 2.1.28+dfsg1-12)",
   "content_text": "Fixed versions: cyrus-sasl2 2.1.28+dfsg1-12.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in openSUSE Leap 16.0 (cyrus-sasl 2.1.28-160000.4.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-160000.4.1, cyrus-sasl-bdb 2.1.28-160000.4.1, cyrus-sasl-saslauthd 2.1.28-160000.4.1, cyrus-sasl-saslauthd-bdb 2.1.28-160000.4.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in openSUSE Tumbleweed (cyrus-sasl 2.1.28-13.1)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-13.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS (cyrus-sasl 2.1.27-150300.4.9.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.27-150300.4.9.1, cyrus-sasl-bdb 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd-bdb 2.1.27-150300.4.9.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS (cyrus-sasl 2.1.27-150300.4.9.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.27-150300.4.9.1, cyrus-sasl-bdb 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd-bdb 2.1.27-150300.4.9.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS (cyrus-sasl 2.1.28-150500.3.12.1 and 2 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150500.3.12.1, cyrus-sasl-bdb 2.1.28-150500.3.12.1, cyrus-sasl-saslauthd 2.1.28-150500.3.12.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS (cyrus-sasl 2.1.28-150500.3.12.1 and 2 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150500.3.12.1, cyrus-sasl-bdb 2.1.28-150500.3.12.1, cyrus-sasl-saslauthd 2.1.28-150500.3.12.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.3 (cyrus-sasl 2.1.27-150300.4.9.1)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.27-150300.4.9.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.4 (cyrus-sasl 2.1.27-150300.4.9.1)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.27-150300.4.9.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-micro-5.5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.5 (cyrus-sasl 2.1.28-150500.3.12.1)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150500.3.12.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Basesystem 15 SP7 (cyrus-sasl 2.1.28-150600.7.17.1 and 1 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150600.7.17.1, cyrus-sasl-saslauthd 2.1.28-150600.7.17.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-module-for-legacy-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Legacy 15 SP7 (cyrus-sasl-bdb 2.1.28-150600.7.17.1 and 1 more)",
   "content_text": "Fixed versions: cyrus-sasl-bdb 2.1.28-150600.7.17.1, cyrus-sasl-saslauthd-bdb 2.1.28-150600.7.17.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-module-for-server-applications-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Server Applications 15 SP7 (cyrus-sasl-bdb 2.1.28-150600.7.17.1 and 1 more)",
   "content_text": "Fixed versions: cyrus-sasl-bdb 2.1.28-150600.7.17.1, cyrus-sasl-saslauthd 2.1.28-150600.7.17.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-12-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 12 SP5-LTSS (cyrus-sasl 2.1.26-14.10.1 and 1 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.26-14.10.1, cyrus-sasl-saslauthd 2.1.26-14.10.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP4-LTSS (cyrus-sasl 2.1.27-150300.4.9.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.27-150300.4.9.1, cyrus-sasl-bdb 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd-bdb 2.1.27-150300.4.9.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP5-LTSS (cyrus-sasl 2.1.28-150500.3.12.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150500.3.12.1, cyrus-sasl-bdb 2.1.28-150500.3.12.1, cyrus-sasl-saslauthd 2.1.28-150500.3.12.1, cyrus-sasl-saslauthd-bdb 2.1.28-150500.3.12.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP6-LTSS (cyrus-sasl 2.1.28-150600.7.17.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150600.7.17.1, cyrus-sasl-bdb 2.1.28-150600.7.17.1, cyrus-sasl-saslauthd 2.1.28-150600.7.17.1, cyrus-sasl-saslauthd-bdb 2.1.28-150600.7.17.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 16.0 (cyrus-sasl 2.1.28-160000.4.1 and 1 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-160000.4.1, cyrus-sasl-saslauthd 2.1.28-160000.4.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP4 (cyrus-sasl 2.1.27-150300.4.9.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.27-150300.4.9.1, cyrus-sasl-bdb 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd 2.1.27-150300.4.9.1, cyrus-sasl-saslauthd-bdb 2.1.27-150300.4.9.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP5 (cyrus-sasl 2.1.28-150500.3.12.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150500.3.12.1, cyrus-sasl-bdb 2.1.28-150500.3.12.1, cyrus-sasl-saslauthd 2.1.28-150500.3.12.1, cyrus-sasl-saslauthd-bdb 2.1.28-150500.3.12.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP6 (cyrus-sasl 2.1.28-150600.7.17.1 and 3 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-150600.7.17.1, cyrus-sasl-bdb 2.1.28-150600.7.17.1, cyrus-sasl-saslauthd 2.1.28-150600.7.17.1, cyrus-sasl-saslauthd-bdb 2.1.28-150600.7.17.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (cyrus-sasl 2.1.28-160000.4.1 and 1 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.28-160000.4.1, cyrus-sasl-saslauthd 2.1.28-160000.4.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107161/fixed/suse-linux-enterprise-server-ltss-extended-security-12-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107161/",
   "title": "CVE-2026-107161 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 (cyrus-sasl 2.1.26-14.10.1 and 1 more)",
   "content_text": "Fixed versions: cyrus-sasl 2.1.26-14.10.1, cyrus-sasl-saslauthd 2.1.26-14.10.1.",
   "date_published": "2026-10-07T19:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106062/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106062/",
   "title": "CVE-2026-106062 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.",
   "date_published": "2026-10-06T20:02:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106062/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106062/",
   "title": "CVE-2026-106062 · Red Hat Enterprise Linux 10 · fixed in openSUSE Leap 16.0 (gimp 3.0.8-bp160.13.1)",
   "content_text": "Fixed versions: gimp 3.0.8-bp160.13.1.",
   "date_published": "2026-10-06T20:02:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106062/fixed/suse-linux-enterprise-module-for-package-hub-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106062/",
   "title": "CVE-2026-106062 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Package Hub 15 SP7 (gimp 2.10.30-150400.3.85.1)",
   "content_text": "Fixed versions: gimp 2.10.30-150400.3.85.1.",
   "date_published": "2026-10-06T20:02:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106062/fixed/suse-linux-enterprise-workstation-extension-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106062/",
   "title": "CVE-2026-106062 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Workstation Extension 15 SP7 (gimp 2.10.30-150400.3.85.1)",
   "content_text": "Fixed versions: gimp 2.10.30-150400.3.85.1.",
   "date_published": "2026-10-06T20:02:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101258/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101258/",
   "title": "CVE-2026-101258 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.",
   "date_published": "2026-10-06T20:02:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101258/fixed/almalinux-10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101258/",
   "title": "CVE-2026-101258 · Red Hat Enterprise Linux 10 · fixed in AlmaLinux 10 (ghostscript 10.02.1-16.el10_2.3 and 6 more)",
   "content_text": "Fixed versions: ghostscript 10.02.1-16.el10_2.3, ghostscript-doc 10.02.1-16.el10_2.3, ghostscript-tools-dvipdf 10.02.1-16.el10_2.3, ghostscript-tools-fonts 10.02.1-16.el10_2.3, ghostscript-tools-printing 10.02.1-16.el10_2.3, libgs 10.02.1-16.el10_2.3, libgs-devel 10.02.1-16.el10_2.3.",
   "date_published": "2026-10-06T20:02:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101258/fixed/almalinux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101258/",
   "title": "CVE-2026-101258 · Red Hat Enterprise Linux 10 · fixed in AlmaLinux 8 (ghostscript 9.27-19.el8_10 and 7 more)",
   "content_text": "Fixed versions: ghostscript 9.27-19.el8_10, ghostscript-doc 9.27-19.el8_10, ghostscript-tools-dvipdf 9.27-19.el8_10, ghostscript-tools-fonts 9.27-19.el8_10, ghostscript-tools-printing 9.27-19.el8_10, ghostscript-x11 9.27-19.el8_10, libgs 9.27-19.el8_10, libgs-devel 9.27-19.el8_10.",
   "date_published": "2026-10-06T20:02:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101258/fixed/almalinux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101258/",
   "title": "CVE-2026-101258 · Red Hat Enterprise Linux 10 · fixed in AlmaLinux 9 (ghostscript 9.54.0-19.el9_8.3 and 7 more)",
   "content_text": "Fixed versions: ghostscript 9.54.0-19.el9_8.3, ghostscript-doc 9.54.0-19.el9_8.3, ghostscript-tools-dvipdf 9.54.0-19.el9_8.3, ghostscript-tools-fonts 9.54.0-19.el9_8.3, ghostscript-tools-printing 9.54.0-19.el9_8.3, ghostscript-x11 9.54.0-19.el9_8.3, libgs 9.54.0-19.el9_8.3, libgs-devel 9.54.0-19.el9_8.3.",
   "date_published": "2026-10-06T20:02:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101258/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101258/",
   "title": "CVE-2026-101258 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2 (ghostscript 9.54.0-9.amzn2.0.14 and 5 more)",
   "content_text": "Fixed versions: ghostscript 9.54.0-9.amzn2.0.14, ghostscript-cups 9.54.0-9.amzn2.0.14, ghostscript-doc 9.54.0-9.amzn2.0.14, ghostscript-gtk 9.54.0-9.amzn2.0.14, libgs 9.54.0-9.amzn2.0.14, libgs-devel 9.54.0-9.amzn2.0.14.",
   "date_published": "2026-10-06T20:02:24Z"
  }
 ]
}