CLSA-2026-1774010344
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1774010344.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1774010344
- Upstream
- Published
- 2026-03-20T12:39:07Z
- Modified
- 2026-06-04T10:03:12.537922797Z
- Summary
- Fix of 8 CVEs
- Details
-
- SECURITY UPDATE: stack buffer overflow in msl.c (attribute handling),
path traversal bypass of security policy, XSS in HTML coder output,
and MSL attribute overflow
- debian/patches/CVE-2026-25797CVE-2026-25965CVE-2026-25968_CVE-2026-25982.patch: Fix memory leaks, stack overflows, integer overflows and out‑of‑bounds reads; add bounds checks, validate DCM entry sizes, sanitize PostScript filenames, canonicalize paths and free resources; escape user-controlled strings written as raw HTML in the HTML coder; cause was unsafe header and filename parsing, incorrect assumptions about byte counts, path resolution, unnormalized path matching allowing policy bypass, and unescaped HTML output enabling cross-site scripting.
- CVE-2026-25797
- CVE-2026-25965
- CVE-2026-25968
- CVE-2026-25982
- SECURITY UPDATE: null pointer dereference in msl.c (repage/roll handlers)
- debian/patches/CVE-2026-25983.patch: move image null‑checks before accessing image attributes in the repage and roll MSL tag handlers; cause was dereferencing the image pointer for page geometry and dimensions before verifying the image was defined.
- CVE-2026-25983
- SECURITY UPDATE: infinite recursion via crafted MSL/SVG/MVG files
- debian/patches/CVE-2026-25971.patch: add global Splay tree guards in MSL and SVG coders to detect and reject recursive image references; block dangerous protocols (ftp, http, mvg, vid) in DrawPrimitive; cause was unbounded recursion through nested image reads.
- CVE-2026-25971
- SECURITY UPDATE: null pointer dereference in msl.c (comment/label handlers)
- debian/patches/CVE-2026-23952.patch: add image null-checks before accessing image properties in the comment and label MSL end-element handlers; cause was dereferencing the image pointer for DeleteImageProperty before verifying the image was defined.
- CVE-2026-23952
- SECURITY UPDATE: MSLPushImage return value not captured
- debian/patches/CVE-2026-25988.patch: change MSLPushImage to return the new image index and capture the return value in the MSL image tag handler; cause was the local index variable not being updated after pushing a new image onto the stack.
- CVE-2026-25988
- SECURITY UPDATE: stack buffer overflow in msl.c (attribute handling),
path traversal bypass of security policy, XSS in HTML coder output,
and MSL attribute overflow
- References