TI-2025-10151 CVE-2025-11083 · GHSA-fmx9-hrmg-3x9v
GNU Binutils Linker elfcode.h elf_swap_shdr heap-based overflow
Priority MEDIUM 55
A vulnerability has been found in GNU Binutils 2.45.
RHSA-2026:0685
Red Hat Update Infrastructure 5 security update
Released 2026-01-15 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
Fixes 8 records
TI-2025-07587 CVE-2025-8291 · GHSA-49g5-f6qw-8mm7
ZIP64 End of Central Directory (EOCD) Locator record offset not checked
Priority MEDIUM 53
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed…
TI-2025-38314 CVE-2025-61984 · GHSA-hh67-847q-q3h9
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from…
Priority MEDIUM 52
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used.
TI-2025-28801 CVE-2025-45582 · GHSA-f93m-9mq4-2fjj
Path traversal in GNU Tar
Priority MEDIUM 52
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process.
TI-2024-05239 CVE-2024-5642 · GHSA-hrvr-7x5w-xpmq
Buffer overread when using an empty list with SSLContext.set_npn_protocols()
Priority LOW 30
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API.
TI-2025-05480 CVE-2025-6069 · GHSA-j5cc-6rx8-ff96
HTMLParser quadratic complexity when processing malformed inputs
Priority LOW 21
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
TI-2025-38315 CVE-2025-61985 · GHSA-8gmf-r74v-362p
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially…
Priority LOW 16
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
TI-2025-05486 CVE-2025-6075 · GHSA-vc2m-m665-8xm2
Quadratic complexity in os.path.expandvars() with user-controlled template
Priority LOW 9
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.