Linux Advisories

USN-8724-1: rabbitmq-c vulnerabilities

Advisoryloom Editor — Thu, 03 Sep 2026 20:12:03 +0000

It was discovered that the rabbitmq-c command-line tools only accepted
credentials on the command line, making them visible to other local users
through the process list. An attacker could possibly use this to obtain
sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)

It was discovered that rabbitmq-c did not correctly compute AMQP frame
lengths, leading to a size_t underflow. A remote attacker could possibly
use this to cause rabbitmq-c to crash, resulting in a denial of service, or
possibly expose sensitive information. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-44235)

It was discovered that rabbitmq-c did not properly validate the frame size
during the AMQP login handshake. A remote attacker could possibly use this
to cause a heap buffer overflow, resulting in a denial of service or
possibly the execution of arbitrary code. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-44236)

It was discovered that rabbitmq-c did not correctly validate the length of
decoded bytes fields, leading to an integer overflow in a bounds check on
32-bit systems. A remote attacker controlling a broker, or able to
intercept an unencrypted connection, could possibly use this to cause an
out-of-bounds read, resulting in a denial of service or the exposure of
sensitive information. (CVE-2026-59986)

It was discovered that rabbitmq-c did not validate the body fragment length
when serialising an AMQP body frame with the amqp_send_frame() API. An
attacker could possibly use this to cause a heap buffer overflow, resulting
in a denial of service (application crash) or possibly the execution of
arbitrary code. This issue did not affect Ubuntu 14.04 LTS.
(CVE-2026-61547)

DSA-6482-1 chromium – security update

Advisoryloom Editor — Thu, 03 Sep 2026 20:12:00 +0000

https://security-tracker.debian.org/tracker/DSA-6482-1

RHSA-2026:63302: Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)

Advisoryloom Editor — Thu, 03 Sep 2026 19:17:11 +0000

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1).The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.Red Hat Product Security has rated this update as having a security impact of Important.

RHSA-2026:59830: Important: OpenShift Container Platform 4.12.97 packages and security update

Advisoryloom Editor — Thu, 03 Sep 2026 15:26:21 +0000

Red Hat OpenShift Container Platform release 4.12.97 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 4.12.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

USN-8720-1: GnuPG vulnerability

Advisoryloom Editor — Thu, 03 Sep 2026 14:06:41 +0000

It was discovered that GnuPG incorrectly validated authentication tag
lengths when parsing CMS messages encrypted with AES-GCM. An attacker could
possibly use this issue to bypass message integrity checks.

USN-8719-1: APR-util vulnerabilities

Advisoryloom Editor — Thu, 03 Sep 2026 13:28:17 +0000

It was discovered that APR-util incorrectly performed password hash
comparisons in a way that was not constant-time.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2025-49506)

It was discovered that APR-util incorrectly handled recursive XML element
quoting. An attacker could possibly use this issue to cause applications
using APR-util to crash, resulting in a denial of service.
(CVE-2026-32327)

It was discovered that the APR-util Redis client incorrectly handled
certain network data, resulting in a heap-based buffer overflow. A remote
attacker could possibly use this issue to cause APR-util applications to
crash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-34501)

It was discovered that the APR-util memcached client incorrectly handled
certain network data, resulting in a heap-based buffer overflow. A remote
attacker could possibly use this issue to cause APR-util applications to
crash or execute arbitrary code. (CVE-2026-34502)

USN-8718-1: SSSD vulnerability

Advisoryloom Editor — Thu, 03 Sep 2026 13:28:16 +0000

It was discovered that SSSD did not properly validate authentication token
lengths when processing PAM responder requests. A local attacker could
possibly use this issue to cause SSSD to crash, resulting in a denial of
service.

RHSA-2026:59831: Important: OpenShift Container Platform 4.12.97 bug fix and security update

Advisoryloom Editor — Thu, 03 Sep 2026 12:43:24 +0000

Red Hat OpenShift Container Platform release 4.12.97 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 4.12.

USN-8717-1: Apache Tika vulnerability

Advisoryloom Editor — Thu, 03 Sep 2026 11:49:59 +0000

It was discovered that Apache Tika’s ISA-Tab parser incorrectly handled
file path resolution. An attacker who could place files in a directory that
Tika subsequently parses could use this issue to read arbitrary files
accessible to the Tika process and have their contents emitted into the
extracted text output.

RHSA-2026:63136: Important: grafana-pcp security update

Advisoryloom Editor — Thu, 03 Sep 2026 11:49:57 +0000

An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.