Most recent entries from all

ALSA-2026:50141 — Important: sg3_utils security, bug fix, and enhancement update

Affected: AlmaLinux:9: sg3_utils, AlmaLinux:9: sg3_utils-devel, AlmaLinux:9: sg3_utils-libs

The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.

Security Fix(es):

* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)

Bug Fix(es) and Enhancement(s):

* sg_inq output conformance for SCSI name string and ATA fields [almalinux-9.8.z] (JIRA:AlmaLinux-188130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-380626

fkie_cve-2026-16313

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

GHSA-wqmp-fw94-rpg4

msrc_CVE-2026-16313 — Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

msrc_CVE-2026-16313

OESA-2026-3244 — sg3_utils security update

Affected: openEuler:24.03-LTS-SP3: sg3_utils, openEuler:24.03-LTS-SP4: sg3_utils, openEuler:20.03-LTS-SP4: sg3_utils, openEuler:22.03-LTS-SP4: sg3_utils, openEuler:24.03-LTS-SP1: sg3_utils

The sg3_utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI (e.g. Fibre Channel (FCP), Serial Attached SCSI (SAS) and the SCSI Parallel Interface(SPI)) many other devices use SCSI command sets. ATAPI cd/dvd drives and SATA disks that connect via a translation layer or a bridge device are examples of devices that use SCSI command sets. Security Fix(es):

RHSA-2026:50141 — Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

RHSA-2026:54769 — Red Hat Security Advisory: OpenShift Container Platform 4.22.10 bug fix and security update

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O samba: Missing access check on reparse point operations libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. unbound: Unbound: Cache manipulation via 'ghost domain names' attack unbound: Unbound: Denial of Service via excessive EDNS options vim: Vim: Arbitrary Code Execution via crafted directory names vim: Vim: Arbitrary code execution via crafted step-definition patterns vim: Vim: Arbitrary code execution via Python omni-completion acl: Symlink traversal privilege escalation via libacl functions vim: Vim: Out-of-bounds Write in Spell File Word Count vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion openssh: OpenSSH: Use-after-free vulnerab…

RLSA-2026:50141 — Important: sg3_utils security, bug fix, and enhancement update

Affected: Rocky Linux:9: sg3_utils

The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.

Security Fix(es):

* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)

Bug Fix(es) and Enhancement(s):

* sg_inq output conformance for SCSI name string and ATA fields [rhel-9.8.z] (JIRA:Rocky Linux-188130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-16313

Affected: Ubuntu:14.04:LTS: sg3-utils, Ubuntu:16.04:LTS: sg3-utils, Ubuntu:18.04:LTS: sg3-utils, Ubuntu:20.04:LTS: sg3-utils, Ubuntu:22.04:LTS: sg3-utils, Ubuntu:24.04:LTS: sg3-utils, Ubuntu:26.04:LTS: sg3-utils

WID-SEC-W-2026-2645 — Red Hat Enterprise Linux (sg3_utils): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorr…

Ein Angreifer mit physischem Zugriff kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.