Osidb Bzimport

A flaw exists where the HTTP server performs a TLS handshake synchronously within the connection-context callback without a deadline. This allows a network-reachable unauthenticated client to stall the handshake process, which prevents the affected listener from accepting new connections.

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.

A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations.

A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.

The PSD plug-in image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. This can result in a stack-based buffer overflow—a condition where a program writes more data to a buffer than it can hold—when opening a specially crafted PSD file, potentially leading to a crash or arbitrary code execution.

A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.

The PlayStation TIM loader, which handles PlayStation image files, contains an integer overflow when calculating the size of the Color Look-Up Table (CLUT). This occurs during the multiplication of the `num colors` and `num cluts` variables, both of which are 16-bit unsigned short integers. A specially crafted image file can trigger this overflow, leading to undefined behavior and causing the plug-in to abort, which results in a denial of service.

A flaw in the `org.keycloak.broker.oidc` package causes the OIDC broker to incorrectly synchronize the `email verified` claim. When an OIDC identity provider is configured with `trustEmail=true` and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but takes the `email verified` status solely from the `id token`. Because there is no validation to ensure the `email verified` claim in the `id token` corresponds to the email address from the userinfo endpoint, a `email verified=true` claim from the `id token` can be applied to a different email address returned by the userinfo endpoint. This occurs if an attacker controls or compromises the upstream OIDC provider. This can lead to arbitrary email addresses being marked as verified in the database, bypassing email-based security controls, or potential account takeover if the application relies on the `email verified` flag for account linking.

A heap buffer overflow exists in the Paint Shop Pro (PSP) file format parser. The issue occurs when the software incorrectly calculates buffer sizes while processing low bit-depth images, which leads to the overwriting of adjacent memory. A remote attacker can exploit this by tricking a user into opening a specially crafted PSP image file, potentially resulting in arbitrary code execution or a denial of service (DoS).

An integer overflow exists in the `hpcups` processing path when handling specially crafted print data. This flaw may allow a remote attacker to escalate privileges or achieve arbitrary code execution. An integer overflow occurs when an arithmetic operation results in a value that exceeds the storage capacity of the integer type used to hold it, potentially leading to memory corruption.

An issue in the administrative interface occurs when Fine-Grained Admin Permissions (FGAP v2) are enabled. An administrator with permission to view a specific role can access a list of all groups assigned to that role because the system fails to verify if the administrator has the necessary permissions to view those specific groups. This allows restricted administrators to discover hidden groups and access metadata, including internal names and custom settings, which may contain sensitive deployment information.

A flaw exists in the `ClientResource` component of the admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator with limited control over specific clients to attach or remove hidden client scopes they are not authorized to manage. This could enable an attacker to inject unauthorized data or permissions into security tokens issued to end-users, potentially leading other applications to grant higher access levels than intended.

An unauthenticated remote attacker can write arbitrary JSON files to the server filesystem via the `/save-document` endpoint. The issue stems from improper input validation that allows a path restriction bypass, enabling the attacker to escape the intended save directory and overwrite critical application configurations or startup scripts. This could result in unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution if the written files are subsequently executed or loaded by the server.

A flaw exists in the Identity Provider (IdP) mapper component, which manages the mapping of user information from external services to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this by creating a "Hardcoded Role" mapper to assign high-level administrative roles, such as `realm-admin`, to themselves or other users. This allows a restricted administrator to bypass security checks and obtain full control over the entire realm.

A flaw exists in the `DocumentBuilderAccessor` where DOCTYPE declarations are not disabled and `FEATURE SECURE PROCESSING` is not enabled. Although external DTD and schema access are blocked, an attacker with artifact-write permissions can upload XML documents containing internal entity-expansion payloads, such as the billion-laughs variant. This can lead to CPU and heap exhaustion, though the JAXP default limit of 64,000 entity expansions provides partial mitigation.

A flaw in `org.keycloak.authorization` allows an authenticated user who possesses a User-Managed Access (UMA) permission ticket for a single resource to bypass per-resource access control. By using a specific permission request prefix, the user can gain unauthorized access to all resources of the same type within the same resource server. This occurs when the resource server is configured in PERMISSIVE policy enforcement mode and affects typed resources with `ownerManagedAccess` enabled that lack an explicit protecting policy. This can lead to unauthorized information disclosure or modification of resources.

A CPU exhaustion Denial of Service (DoS) occurs due to superlinear (approximately O(n²)) behavior in the `parse link text()` function. When processing Markdown containing numerous consecutive [ characters, the function repeatedly scans the input using a regex search within a loop, re-scanning large portions of the remaining string in each iteration. This quadratic-time behavior allows an attacker to trigger excessive CPU usage using a small payload.

A double free flaw exists in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. A malicious SSH server can exploit this to cause client-side process termination, leading to a Denial of Service (DoS).

A flaw in OpenSSH allows a local unprivileged attacker on a Linux client host to hijack client-side X11 forwarding connections. This occurs when X11 forwarding is enabled and a local UNIX-domain X socket is used, allowing the attacker to pre-bind the preferred abstract X socket name. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may enable manipulation of the forwarded session.

A regression occurred when a rework commit replaced specific overflow checks with a general signed comparison. This issue is triggered when a client sends a Range request with a suffix length that exceeds the content size. Because the resulting negative start value is not properly clamped, the system generates malformed HTTP 206 responses and causes log flooding.