Coverage tagged "Open source".
Posted by Demi Marie Obenour on Oct 25 In light of the size of the upstream patch, would it be better to handle out of memory by crashing the process instead?
Posted by Jonathan Brossard on Oct 25 1. Summary A soundness-audit bypass in the Rocq (formerly Coq) module system allows construction of a proof of False that Print Assumptions reports as closed…
Posted by Jonathan Brossard on Oct 25 1. Summary A soundness bug in the Rocq (formerly Coq) kernel allows construction of a checked proof of False — and by extension, any proposition, including 0 = 1…
Posted by Jonathan Brossard on Oct 25 1. Summary A soundness bug in the Rocq (formerly Coq) kernel's guard checker allows construction of a checked proof of False — and by extension, any proposition…
Posted by Jonathan Brossard on Oct 25 1. Summary A soundness bug in the Rocq (formerly Coq) kernel's guard checker allows construction of a checked proof of False — and by extension, any proposition…
Posted by Jonathan Brossard on Oct 25 1. Summary A soundness bug in the Rocq (formerly Coq) kernel's guard checker allows construction of a checked proof of False — and by extension, any proposition…
Posted by Jonathan Brossard on Oct 25 1. Summary A soundness bug in the Lean 4 kernel allows construction of a checked proof of False — and by extension, any proposition, including 0 = 1 — without…
Posted by Jonathan Brossard on Oct 25 1. Summary A soundness bug in the Lean 4 kernel allows construction of a checked proof of False — and by extension, any proposition, including 0 = 1 — without…
Posted by Alexander A. Shvedov on Oct 25 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60477 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3…
OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining…
CVE-2026-111497 demonstrates how a single memory-corruption bug in a widely reused native decoder can affect applications far beyond the runtime where it was first discovered. CVE-2026-111497 was…
Posted by Alexander A. Shvedov on Oct 24 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed…
Posted by Roman Kuligin on Oct 24 Hello, I have developed a backported .patch for EOL versions of PHP (specifically PHP 5.4, 5.5, and 5.6) to mitigate the critical PHP2Shell Out-of-Memory (OOM)…
Posted by Security @ Red Eagle Tech on Oct 24 Hello, CVE-2026-107080 has been assigned to the issue reported here on 5 October 2026. MITRE's description: OpenJPEG 2.4.0 through 2.5.4, and git master…
Posted by Valtteri Vuorikoski on Oct 24 Announcement below was posted to the Apache Traffic Server mailing lists a few days ago. Forwarded message from Masakazu Kitajo Date: Tue, 20 Oct 2026 20:07:34…
Posted by Alan Coopersmith on Oct 24 Forwarded Message Subject: [Security-announce][CVE-2026-115557] Distrust compromised intermediate certificates in ssl module Date: Sat, 24 Oct 2026 14:20:01 +0000…
Posted by Robert Rothenberg on Oct 24 CVE-2026-114629 CPAN Security Group CVE ID: CVE-2026-114629 Distribution: Web-Simple Versions: before 0.035 MetaCPAN: https://metacpan.org/dist/Web-Simple VCS…
Posted by Michael Orlitzky on Oct 24 Only those dumb enough to bundle or statically link their dependencies. The bare minimum in terms of software engineering would prevent these 1990-ass…
Posted by Jeffrey Walton on Oct 24 Yes, you're correct. My bad. Ugh...
Posted by Joachim Rütter on Oct 24 Hello, jxrlib, Microsoft's JPEG XR library (abandoned upstream), has memory bugs that a damaged JPEG XR file of a few hundred bytes triggers, including a heap…
