Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Stable Channel Update for Desktop
tag:blogger.com,1999:blog-8982037438137564684.post-58901880568994851212026-10-20T13:09:05.710-07:002026-11-03T13:45:58.345-08:00Stable Channel Update for…
Hoch 8.2Software
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap…
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
Hoch 8.8Apple-Telefone
This issue was addressed by enforcing library validation on the affected binaries.
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
Kritisch 9.8Software
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async…
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.
Hoch 7.5Apple-Telefone
The issue was addressed with additional app bundle integrity checks.
The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.
Kritisch 9.8Software
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because…
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.
Hoch 8.8Software
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting…
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.
Hoch 8.8Software
MLflow before 3.18.0 contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem…
MLflow before 3.18.0 contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server…
Hoch 7.5Linux-Server
USN-9064-1: Pillow vulnerabilities
It was discovered that Pillow could enter an infinite loop while determining the frame count of a MIC image. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112390) It was discovered that Pillow's PdfParser.get_value() could recurse without a limit while reading nested PDF objects. An attacker could possibly use this issue to cause a denial of…
Kritisch 9.8Linux-Server
Red Hat Enterprise Linux (perl-yaml, pillow): Mehrere Schwachstellen
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading…
Hoch 8.8Linux-Server
USN-9064-1: Pillow vulnerabilities
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is…
Hoch 8.7Linux-Server
Red Hat Enterprise Linux (pillow and aspell): Mehrere Schwachstellen
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU…
Hoch 8.7Linux-Server
Red Hat Enterprise Linux (pillow and aspell): Mehrere Schwachstellen
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny…
Hoch 8.2Linux-Server
USN-9064-1: Pillow vulnerabilities
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed…
Hoch 8.7Linux-Server
Red Hat Enterprise Linux (pillow and aspell): Mehrere Schwachstellen
It was discovered that Pillow could enter an infinite loop while determining the frame count of a MIC image. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112390) It was discovered that Pillow's PdfParser.get_value() could recurse without a limit while reading nested PDF objects. An attacker could possibly use this issue to cause a denial of…
Hoch 7.5Linux-Server
USN-9064-1: Pillow vulnerabilities
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version…
Hoch 8.7Linux-Server
Red Hat Enterprise Linux (pillow and aspell): Mehrere Schwachstellen
It was discovered that Pillow could enter an infinite loop while determining the frame count of a MIC image. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112390) It was discovered that Pillow's PdfParser.get_value() could recurse without a limit while reading nested PDF objects. An attacker could possibly use this issue to cause a denial of…
Hoch 8.7Linux-Server
Red Hat Enterprise Linux (pillow and aspell): Mehrere Schwachstellen
Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue…
Hoch 8.8Linux-Server
USN-9064-1: Pillow vulnerabilities
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose…
Kritisch 9.8Linux-Server
USN-9064-1: Pillow vulnerabilities
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail()…