Most recent entries from all

ALSA-2026:18143 — Moderate: p11-kit security update

Affected: AlmaLinux:10: p11-kit, AlmaLinux:10: p11-kit-client, AlmaLinux:10: p11-kit-devel, AlmaLinux:10: p11-kit-server, AlmaLinux:10: p11-kit-trust

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.

Security Fix(es):

* p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn: BELL-CVE-2026-2100 — CVE-2026-2100 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2026-avi-0266 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob…

certfr-2026-avi-0266

EUVD-2026-377855

fkie_cve-2026-2100

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

GHSA-hq85-3f6c-jx84

msrc_CVE-2026-2100 — P11-kit: p11-kit: null dereference via c_derivekey with specific null parameters

msrc_CVE-2026-2100

openSUSE-SU-2026:10169-1 — libp11-kit0-0.26.2-1.1 on GA media

libp11-kit0-0.26.2-1.1 on GA media

RHSA-2026:21275 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: Out-of-memory when loading Plist glib: GLib: Buffer underflow in GVariant parser leads to heap corruption glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow cpython: Header injection via newlines in data URL mediatype in Python firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing cpython: Header injection in http.cookies.Morsel in Python cpython: wsgiref.headers.Headers allows header newline injection in Python python: Python: HTTP header injection via CR/LF in proxy tunnel headers p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters cpython: CPython: Logging Bypass in Legacy .pyc File Handling cpython: Incomplete control character validation in http.cookies cpython: Stack overflow parsing XML with deeply nested DTD content models python: Python: Command-line option injection in webbrowser.open() via crafted URLs python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data openssl: openssl: Information Disclosure f…

Withdrawn: UBUNTU-CVE-2026-2100

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: p11-kit, Ubuntu:16.04:LTS: p11-kit, Ubuntu:18.04:LTS: p11-kit, Ubuntu:20.04:LTS: p11-kit, Ubuntu:22.04:LTS: p11-kit, Ubuntu:24.04:LTS: p11-kit, Ubuntu:25.10: p11-kit

[NULL dereference via C_DeriveKey with specific NULL parameters]

WID-SEC-W-2026-1267 — Red Hat Hardened Images RPMs: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Hardened Images RPMs ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Rechte zu erweitern, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.