Security feed

25 October 2026

advisoryOfficial CVE List25 Oct 2026

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-14104

util-linux

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 7

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 8

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 9

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Hardened Images

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Insights proxy 1.5

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 6

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 7

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/22/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/23/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2025-14104
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #23059 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:12:37 GMT
Publisher date: Fri, 05 Dec 2025 16:22:09 GMT

Read the original announcement

advisoryOfficial CVE List25 Oct 2026

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-18495

Red Hat Hardened Images

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 4

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 6

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 7

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 8

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ceph Storage 9

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 6

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 7

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 7

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Hardened Images

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-18495
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #12054 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:01:41 GMT
Publisher date: Fri, 11 Sep 2026 17:41:36 GMT

Read the original announcement