Alpine: glib: security update to 2.86.5-r0

medium Tenable Cloud Security Plugin ID 478650

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory
allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to
exhaust available memory and cause denial of service. (CVE-2026-61870)

- ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when
parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger
the vulnerability and cause application crashes. (CVE-2026-61857)

- ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the
-script operation due to missing security policy checks. This allows reading files from paths that are
otherwise disallowed by the configured security policy. (CVE-2026-61859)

- ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when
freetype initialization fails: the method does not exit and continues to use memory that was already
freed. This can be triggered during image processing and may lead to a denial of service. (CVE-2026-61860)

- ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when
memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to
reference freed memory, potentially enabling denial of service or code execution. (CVE-2026-61861)

Solution

Update the glib library and its related packages to version 2.86.5-r0 or later.

Plugin Details

Severity: Medium

ID: 478650

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 11/8/2026

Updated: 11/8/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-61870

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-61861

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/11/2026

Reference Information

CVE: CVE-2026-61857, CVE-2026-61859, CVE-2026-61860, CVE-2026-61861, CVE-2026-61862, CVE-2026-61863, CVE-2026-61864, CVE-2026-61866, CVE-2026-61869, CVE-2026-61870

Detections

Analytics