{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat Enterprise Linux 7: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--red-hat-enterprise-linux-7/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--red-hat-enterprise-linux-7/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115207/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115207/",
   "title": "CVE-2026-115207 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (patch 2.8.1-1)",
   "content_text": "Fixed versions: patch 2.8.1-1.",
   "date_published": "2026-10-26T08:16:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115486/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115486/",
   "title": "CVE-2026-115486 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.",
   "date_published": "2026-10-23T00:16:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115485/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115485/",
   "title": "CVE-2026-115485 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.",
   "date_published": "2026-10-23T00:16:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115484/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115484/",
   "title": "CVE-2026-115484 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.",
   "date_published": "2026-10-23T00:16:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115221/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115221/",
   "title": "CVE-2026-115221 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. Consequently, an enrolled host can disrupt services by revoking certificates belonging to other entities.",
   "date_published": "2026-10-22T21:13:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115207/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115207/",
   "title": "CVE-2026-115207 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.",
   "date_published": "2026-10-22T10:16:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85518/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85518/",
   "title": "CVE-2026-85518 · Red Hat Hardened Images · disclosed",
   "content_text": "A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.",
   "date_published": "2026-10-21T19:42:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85518/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85518/",
   "title": "CVE-2026-85518 · Red Hat Hardened Images · fixed in openSUSE Tumbleweed (openscap 1.4.6-1.1)",
   "content_text": "Fixed versions: openscap 1.4.6-1.1.",
   "date_published": "2026-10-21T19:42:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114038/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114038/",
   "title": "CVE-2026-114038 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).",
   "date_published": "2026-10-21T00:26:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114038/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114038/",
   "title": "CVE-2026-114038 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (multipath-tools 0.15.1-1)",
   "content_text": "Fixed versions: multipath-tools 0.15.1-1.",
   "date_published": "2026-10-21T00:26:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112177/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112177/",
   "title": "CVE-2026-112177 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.",
   "date_published": "2026-10-20T07:25:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112261/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112261/",
   "title": "CVE-2026-112261 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.",
   "date_published": "2026-10-19T21:37:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112258/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112258/",
   "title": "CVE-2026-112258 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.",
   "date_published": "2026-10-19T21:37:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112257/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112257/",
   "title": "CVE-2026-112257 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.",
   "date_published": "2026-10-19T21:37:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112260/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112260/",
   "title": "CVE-2026-112260 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.",
   "date_published": "2026-10-19T19:24:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112259/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112259/",
   "title": "CVE-2026-112259 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application.",
   "date_published": "2026-10-19T18:42:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112214/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112214/",
   "title": "CVE-2026-112214 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.",
   "date_published": "2026-10-19T12:15:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112210/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112210/",
   "title": "CVE-2026-112210 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.",
   "date_published": "2026-10-19T11:39:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89096/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89096/",
   "title": "CVE-2026-89096 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.",
   "date_published": "2026-10-16T23:06:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89096/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89096/",
   "title": "CVE-2026-89096 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (nfs-utils 1:3.1.1-1)",
   "content_text": "Fixed versions: nfs-utils 1:3.1.1-1.",
   "date_published": "2026-10-16T23:06:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89088/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89088/",
   "title": "CVE-2026-89088 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).",
   "date_published": "2026-10-16T23:06:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89088/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89088/",
   "title": "CVE-2026-89088 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2 (parted 3.1-29.amzn2.0.1 and 1 more)",
   "content_text": "Fixed versions: parted 3.1-29.amzn2.0.1, parted-devel 3.1-29.amzn2.0.1.",
   "date_published": "2026-10-16T23:06:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89088/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89088/",
   "title": "CVE-2026-89088 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2023 (parted 3.4-2.amzn2023.0.3 and 1 more)",
   "content_text": "Fixed versions: parted 3.4-2.amzn2023.0.3, parted-devel 3.4-2.amzn2023.0.3.",
   "date_published": "2026-10-16T23:06:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89088/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89088/",
   "title": "CVE-2026-89088 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (parted 3.8-2)",
   "content_text": "Fixed versions: parted 3.8-2.",
   "date_published": "2026-10-16T23:06:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89085/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89085/",
   "title": "CVE-2026-89085 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.",
   "date_published": "2026-10-16T23:04:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89085/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89085/",
   "title": "CVE-2026-89085 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2 (parted 3.1-29.amzn2.0.1 and 1 more)",
   "content_text": "Fixed versions: parted 3.1-29.amzn2.0.1, parted-devel 3.1-29.amzn2.0.1.",
   "date_published": "2026-10-16T23:04:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89085/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89085/",
   "title": "CVE-2026-89085 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2023 (parted 3.4-2.amzn2023.0.3 and 1 more)",
   "content_text": "Fixed versions: parted 3.4-2.amzn2023.0.3, parted-devel 3.4-2.amzn2023.0.3.",
   "date_published": "2026-10-16T23:04:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89085/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89085/",
   "title": "CVE-2026-89085 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (parted 3.8-2)",
   "content_text": "Fixed versions: parted 3.8-2.",
   "date_published": "2026-10-16T23:04:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89085/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89085/",
   "title": "CVE-2026-89085 · Red Hat Enterprise Linux 10 · fixed in openSUSE Tumbleweed (parted 3.8-1.1)",
   "content_text": "Fixed versions: parted 3.8-1.1.",
   "date_published": "2026-10-16T23:04:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111802/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111802/",
   "title": "CVE-2026-111802 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.",
   "date_published": "2026-10-16T22:03:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-17591/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-17591/",
   "title": "CVE-2026-17591 · Red Hat Hardened Images · disclosed",
   "content_text": "A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.",
   "date_published": "2026-10-16T22:03:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-17591/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-17591/",
   "title": "CVE-2026-17591 · Red Hat Hardened Images · fixed in Debian 14 (libarchive 3.8.9-1)",
   "content_text": "Fixed versions: libarchive 3.8.9-1.",
   "date_published": "2026-10-16T22:03:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-17591/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-17591/",
   "title": "CVE-2026-17591 · Red Hat Hardened Images · fixed in Red Hat hummingbird 1 (bsdcat 0:3.8.9-2.1.hum1 and 5 more)",
   "content_text": "Fixed versions: bsdcat 0:3.8.9-2.1.hum1, bsdcpio 0:3.8.9-2.1.hum1, bsdtar 0:3.8.9-2.1.hum1, bsdunzip 0:3.8.9-2.1.hum1, libarchive 0:3.8.9-2.1.hum1, libarchive-devel 0:3.8.9-2.1.hum1.",
   "date_published": "2026-10-16T22:03:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-62438/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-62438/",
   "title": "CVE-2026-62438 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.",
   "date_published": "2026-10-16T21:56:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-62438/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-62438/",
   "title": "CVE-2026-62438 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (gimp 3.2.6-1)",
   "content_text": "Fixed versions: gimp 3.2.6-1.",
   "date_published": "2026-10-16T21:56:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-62439/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-62439/",
   "title": "CVE-2026-62439 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.",
   "date_published": "2026-10-16T21:54:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-62439/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-62439/",
   "title": "CVE-2026-62439 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (gimp 3.2.6-1)",
   "content_text": "Fixed versions: gimp 3.2.6-1.",
   "date_published": "2026-10-16T21:54:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85977/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85977/",
   "title": "CVE-2026-85977 · Red Hat Hardened Images · disclosed",
   "content_text": "A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.",
   "date_published": "2026-10-16T18:20:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85977/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85977/",
   "title": "CVE-2026-85977 · Red Hat Hardened Images · fixed in openSUSE Tumbleweed (libtirpc 1.3.8-1.1)",
   "content_text": "Fixed versions: libtirpc 1.3.8-1.1.",
   "date_published": "2026-10-16T18:20:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85977/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85977/",
   "title": "CVE-2026-85977 · Red Hat Hardened Images · fixed in Red Hat hummingbird 1 (libtirpc 0:1.3.8-0.1.hum1 and 1 more)",
   "content_text": "Fixed versions: libtirpc 0:1.3.8-0.1.hum1, libtirpc-devel 0:1.3.8-0.1.hum1.",
   "date_published": "2026-10-16T18:20:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85231/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85231/",
   "title": "CVE-2026-85231 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.",
   "date_published": "2026-10-16T18:20:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85231/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85231/",
   "title": "CVE-2026-85231 · Red Hat Enterprise Linux 10 · fixed in openSUSE Tumbleweed (libtirpc 1.3.8-1.1)",
   "content_text": "Fixed versions: libtirpc 1.3.8-1.1.",
   "date_published": "2026-10-16T18:20:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89098/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89098/",
   "title": "CVE-2026-89098 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.",
   "date_published": "2026-10-16T17:43:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89098/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89098/",
   "title": "CVE-2026-89098 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (nfs-utils 1:3.1.1-1)",
   "content_text": "Fixed versions: nfs-utils 1:3.1.1-1.",
   "date_published": "2026-10-16T17:43:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111581/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111581/",
   "title": "CVE-2026-111581 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.",
   "date_published": "2026-10-16T15:42:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111555/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111555/",
   "title": "CVE-2026-111555 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.",
   "date_published": "2026-10-16T12:19:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111555/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111555/",
   "title": "CVE-2026-111555 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (luksmeta 10-2)",
   "content_text": "Fixed versions: luksmeta 10-2.",
   "date_published": "2026-10-16T12:19:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105958/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105958/",
   "title": "CVE-2026-105958 · Red Hat Enterprise Linux 6 · disclosed",
   "content_text": "A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.",
   "date_published": "2026-10-16T12:18:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105958/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105958/",
   "title": "CVE-2026-105958 · Red Hat Enterprise Linux 6 · fixed in Amazon Linux 2 (spice-server 0.14.0-10.amzn2 and 1 more)",
   "content_text": "Fixed versions: spice-server 0.14.0-10.amzn2, spice-server-devel 0.14.0-10.amzn2.",
   "date_published": "2026-10-16T12:18:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105958/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105958/",
   "title": "CVE-2026-105958 · Red Hat Enterprise Linux 6 · fixed in openSUSE Tumbleweed (spice 0.16.0-3.1)",
   "content_text": "Fixed versions: spice 0.16.0-3.1.",
   "date_published": "2026-10-16T12:18:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105959/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105959/",
   "title": "CVE-2026-105959 · Red Hat Enterprise Linux 6 · disclosed",
   "content_text": "A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.",
   "date_published": "2026-10-16T11:53:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105959/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105959/",
   "title": "CVE-2026-105959 · Red Hat Enterprise Linux 6 · fixed in Amazon Linux 2 (spice-server 0.14.0-10.amzn2 and 1 more)",
   "content_text": "Fixed versions: spice-server 0.14.0-10.amzn2, spice-server-devel 0.14.0-10.amzn2.",
   "date_published": "2026-10-16T11:53:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105959/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105959/",
   "title": "CVE-2026-105959 · Red Hat Enterprise Linux 6 · fixed in openSUSE Tumbleweed (spice 0.16.0-3.1)",
   "content_text": "Fixed versions: spice 0.16.0-3.1.",
   "date_published": "2026-10-16T11:53:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.21 (cifs-utils 7.1-r1)",
   "content_text": "Fixed versions: cifs-utils 7.1-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.22 (cifs-utils 7.3-r1)",
   "content_text": "Fixed versions: cifs-utils 7.3-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.23 (cifs-utils 7.4-r1)",
   "content_text": "Fixed versions: cifs-utils 7.4-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.24 (cifs-utils 7.5-r1)",
   "content_text": "Fixed versions: cifs-utils 7.5-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2 (cifs-utils 6.2-10.amzn2.0.5 and 1 more)",
   "content_text": "Fixed versions: cifs-utils 6.2-10.amzn2.0.5, cifs-utils-devel 6.2-10.amzn2.0.5.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Amazon Linux 2023 (cifs-utils 7.7-145.amzn2023.0.1 and 3 more)",
   "content_text": "Fixed versions: cifs-utils 7.7-145.amzn2023.0.1, cifs-utils-devel 7.7-145.amzn2023.0.1, cifs-utils-info 7.7-145.amzn2023.0.1, pam_cifscreds 7.7-145.amzn2023.0.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Debian 13 (cifs-utils 2:7.4-1+deb13u1)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1+deb13u1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (cifs-utils 2:7.9-1)",
   "content_text": "Fixed versions: cifs-utils 2:7.9-1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.3 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.4 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.5 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Basesystem 15 SP7 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-12-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 12 SP5-LTSS (cifs-utils 6.9-13.32.2)",
   "content_text": "Fixed versions: cifs-utils 6.9-13.32.2.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP4-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP5-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP6-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP4 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP5 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP6 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-ltss-extended-security-12-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 (cifs-utils 6.9-13.32.2)",
   "content_text": "Fixed versions: cifs-utils 6.9-13.32.2.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 22.04 LTS (cifs-utils 2:6.14-1ubuntu0.7)",
   "content_text": "Fixed versions: cifs-utils 2:6.14-1ubuntu0.7.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 24.04 LTS (cifs-utils 2:7.0-2ubuntu0.6)",
   "content_text": "Fixed versions: cifs-utils 2:7.0-2ubuntu0.6.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 26.04 LTS (cifs-utils 2:7.4-1ubuntu0.26.04.4)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1ubuntu0.26.04.4.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 26.10 (cifs-utils 2:7.4-1ubuntu3.1)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1ubuntu3.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-110777/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-110777/",
   "title": "CVE-2026-110777 · GNOME Evolution Data Server · disclosed",
   "content_text": "A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.",
   "date_published": "2026-10-14T18:08:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109968/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109968/",
   "title": "CVE-2026-109968 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.",
   "date_published": "2026-10-14T12:50:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100229/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100229/",
   "title": "CVE-2026-100229 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.",
   "date_published": "2026-10-14T10:02:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109971/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109971/",
   "title": "CVE-2026-109971 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.",
   "date_published": "2026-10-14T10:01:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109970/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109970/",
   "title": "CVE-2026-109970 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.",
   "date_published": "2026-10-14T10:01:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109969/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109969/",
   "title": "CVE-2026-109969 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.",
   "date_published": "2026-10-14T10:00:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100231/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100231/",
   "title": "CVE-2026-100231 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata, potentially causing a denial of service or limited memory corruption.",
   "date_published": "2026-10-14T10:00:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86476/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86476/",
   "title": "CVE-2026-86476 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.",
   "date_published": "2026-10-14T10:00:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-110036/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-110036/",
   "title": "CVE-2026-110036 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.",
   "date_published": "2026-10-13T18:45:47Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105460/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105460/",
   "title": "CVE-2026-105460 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.",
   "date_published": "2026-10-13T15:12:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109976/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109976/",
   "title": "CVE-2026-109976 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.",
   "date_published": "2026-10-13T12:17:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109854/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109854/",
   "title": "CVE-2026-109854 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.",
   "date_published": "2026-10-13T09:16:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109854/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109854/",
   "title": "CVE-2026-109854 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (m17n-lib 1.8.7-1)",
   "content_text": "Fixed versions: m17n-lib 1.8.7-1.",
   "date_published": "2026-10-13T09:16:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-108094/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-108094/",
   "title": "CVE-2026-108094 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.",
   "date_published": "2026-10-12T14:43:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-108094/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-108094/",
   "title": "CVE-2026-108094 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (mutter 50.5-1)",
   "content_text": "Fixed versions: mutter 50.5-1.",
   "date_published": "2026-10-12T14:43:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-108093/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-108093/",
   "title": "CVE-2026-108093 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and crash the GIMP application.",
   "date_published": "2026-10-09T16:45:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-108063/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-108063/",
   "title": "CVE-2026-108063 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash, resulting in a Denial of Service (DoS).",
   "date_published": "2026-10-09T13:26:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107655/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107655/",
   "title": "CVE-2026-107655 · Red Hat Hardened Images · disclosed",
   "content_text": "A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.",
   "date_published": "2026-10-09T08:55:35Z"
  }
 ]
}