Eclipse Java Extension, Linux Utilities, and PyPI Package Vulnerabilities
Command injection in Eclipse vscode-java, symlink traversal in Linux utilities, and a security policy bypass in PyPI's fast-uri are among today's key vulnerabilities.
A command injection vulnerability in the JavaDoc hover provider of the Eclipse vscode-java extension could allow attackers to execute arbitrary code. This flaw, identified as CVE-2026-12856, affects the popular VS Code extension and may be exploited through crafted JavaDoc comments. Users are advised to update to the latest version of the extension to mitigate this risk.
Multiple vulnerabilities have been disclosed in Linux utilities, including symlink traversal and arbitrary file overwrite flaws. CVE-2026-54369 and CVE-2026-54371 detail symlink traversal privilege escalation risks in ACL and Attr respectively, allowing attackers to overwrite arbitrary files. Additionally, CVE-2026-41991 in Gzip presents an arbitrary file overwrite vulnerability via insecure temporary file handling in the gzexe utility. These issues highlight the need for careful handling of file operations and permissions in system utilities.
A security policy bypass vulnerability exists in the PyPI package fast-uri due to improper Unicode hostname canonicalization. CVE-2026-13676 allows for potential bypasses of security policies by exploiting how the package handles internationalized domain names. Developers using this package should ensure they are using updated versions and are aware of the potential for canonicalization issues.
A heap-based buffer overflow vulnerability in Debian's vtk-dicom package, specifically in vtkDICOMItem::NewDataElement, could lead to arbitrary code execution. Identified as CVE-2026-22879, this flaw arises from improper handling of data elements within the DICOM item structure. Users of this package should apply any available security updates from Debian.
FFmpeg's RASC video decoder contains a vulnerability where improper handling of 32-bit reads and writes before a boundary check, and validation of DLTA regions in pixel units rather than byte units, could be exploited. CVE-2026-58049, affecting Debian systems, may allow for memory corruption issues when processing malformed RASC video data.
The TIFF decoder in Debian systems has a vulnerability where it does not limit the size of tiles in tiled images. This could permit a malicious or corrupt image to cause unbounded memory consumption, potentially leading to denial-of-service conditions. CVE-2026-46602 underscores the importance of input validation for image processing libraries.
A buffer overflow vulnerability in libxml2's xmlcatalog utility could lead to arbitrary code execution. CVE-2026-11979, affecting systems using this XML parsing library, stems from insufficient bounds checking when processing catalog entries. Ensure libxml2 is updated to the latest secure version.