https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:51:05 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:8510 <p><strong>Affected:</strong> AlmaLinux:9: bsdtar, AlmaLinux:9: libarchive, AlmaLinux:9: libarchive-devel</p> <p>The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.</p> <p>Security Fix(es):</p> <p>* libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424) * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: bsdtar, AlmaLinux:9: libarchive, AlmaLinux:9: libarchive-devel</p> <p>The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.</p> <p>Security Fix(es):</p> <p>* libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424) * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:8510 https://cve.radiocsirt.org/vuln/bdu:2026-07332 bdu:2026-07332 https://cve.radiocsirt.org/vuln/bdu:2026-07332 https://cve.radiocsirt.org/vuln/bell-cve-2026-5121 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2026-5121 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/euvd-2026-377856 EUVD-2026-377856 https://cve.radiocsirt.org/vuln/euvd-2026-377856 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5121 <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.</p> <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-5121 https://cve.radiocsirt.org/vuln/ghsa-2vwv-vqpv-v8vc <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.</p> <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.</p> https://cve.radiocsirt.org/vuln/ghsa-2vwv-vqpv-v8vc https://cve.radiocsirt.org/vuln/icsa-26-202-04 <p>SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below.</p> <p>Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.</p> <p>SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below.</p> <p>Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.</p> https://cve.radiocsirt.org/vuln/icsa-26-202-04 https://cve.radiocsirt.org/vuln/msrc_cve-2026-5121 msrc_CVE-2026-5121 https://cve.radiocsirt.org/vuln/msrc_cve-2026-5121 https://cve.radiocsirt.org/vuln/ncsc-2026-0229 NCSC-2026-0229 https://cve.radiocsirt.org/vuln/ncsc-2026-0229 https://cve.radiocsirt.org/vuln/oesa-2026-1940 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: libarchive</p> <p>is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security Fix(es):</p> <p>A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)</p> <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: libarchive</p> <p>is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security Fix(es):</p> <p>A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)</p> <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1940 https://cve.radiocsirt.org/vuln/opensuse-su-2026:20797-1 <p>Security update for libarchive</p> <p>Security update for libarchive</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:20797-1 https://cve.radiocsirt.org/vuln/rhsa-2026:10065 <p>libxslt: Processing web content may disclose sensitive information nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing net/url: Incorrect parsing of IPv6 host literals in net/url vim: Vim: Arbitrary code execution via &#39;helpfile&#39; option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files vim: Vim: Arbitrary code execution via command injection in glob() function</p> <p>libxslt: Processing web content may disclose sensitive information nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing net/url: Incorrect parsing of IPv6 host literals in net/url vim: Vim: Arbitrary code execution via &#39;helpfile&#39; option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files vim: Vim: Arbitrary code execution via command injection in glob() function</p> https://cve.radiocsirt.org/vuln/rhsa-2026:10065 https://cve.radiocsirt.org/vuln/ssa-585531 <p>SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below.</p> <p>Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.</p> <p>SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below.</p> <p>Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.</p> https://cve.radiocsirt.org/vuln/ssa-585531 https://cve.radiocsirt.org/vuln/suse-su-2026:21757-1 <p>Security update for libarchive</p> <p>Security update for libarchive</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21757-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5121 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libarchive, Ubuntu:Pro:16.04:LTS: libarchive, Ubuntu:Pro:18.04:LTS: libarchive, Ubuntu:Pro:20.04:LTS: libarchive, Ubuntu:22.04:LTS: libarchive, Ubuntu:24.04:LTS: libarchive, Ubuntu:25.10: libarchive, Ubuntu:26.04:LTS: libarchive</p> <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libarchive, Ubuntu:Pro:16.04:LTS: libarchive, Ubuntu:Pro:18.04:LTS: libarchive, Ubuntu:Pro:20.04:LTS: libarchive, Ubuntu:22.04:LTS: libarchive, Ubuntu:24.04:LTS: libarchive, Ubuntu:25.10: libarchive, Ubuntu:26.04:LTS: libarchive</p> <p>A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5121 https://cve.radiocsirt.org/vuln/vde-2026-088 <p>The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.</p> <p>The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25</p> <p>All other vulnerabilities are to be fixed in the upcoming releases.</p> <p>The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.</p> <p>The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25</p> <p>All other vulnerabilities are to be fixed in the upcoming releases.</p> https://cve.radiocsirt.org/vuln/vde-2026-088 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0923 <p>Ein entfernter Angreifer kann eine Schwachstelle in libarchive ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter Angreifer kann eine Schwachstelle in libarchive ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0923