What this server has with the tag: posts by people here, and posts from elsewhere that reached it. There's more of it on infosec.exchange, sonomu.club.
#git command https remote is affected by the #brotli buffer overflow vulnerability CVE-2026-111497 since it enables compression support:
https://github.com/git/git/blob/7e34d8174dcda3435d1404c9a30bef46afe6c13e/http.c#L2284
https://github.com/git/git/blob/7e34d8174dcda3435d1404c9a30bef46afe6c13e/remote-curl.c#L980
Make sure to update brotli as soon as possible.
For some reason the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is far more wider issue. Brotli compression is supported by many client side applications processing HTTP responses. While some of them have sandboxes and quick update cycle (read: web browsers), many don't. In particular many devices and applications using #curl / libcurl are affected and must be updated ASAP.
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497
Linux security:
I was thinking about something. If I use a non-FOSS on a Debian machine, what is the best way to know what it is doing? Take the app Beeper for example which makes it possible to talk to people with Messenger without being sucked further into the metaverse.
I DO realize that I should behave like everything I write is being tattooed directly on Zuck's ass, but how do I know it is not doing anything besides sucking up the text I type into the program?
allheim has been updated.
