Advisory ROSA-SA-2025-2639

software: faad2 2.11.1 OS: ROSA-CHROME packageevrstring: faad2-2.11.1-1 CVE-ID: CVE-2023-38858 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Buffer overflow vulnerability in infaad2 allows a remote attacker to execute arbitrary code via the mp4info function. CVE-STATUS: The vulnerability has been...

Advisory ROSA-SA-2025-2636

software: audiofile 0.3.6 OS: ROSA-CHROME packageevrstring: audiofile-0.3.6 CVE-ID: CVE-2015-7747 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Buffer overflow vulnerability in audiofile allows an attacker to cause a denial of service or execute arbitrary code through a specially crafted audio file...

Advisory ROSA-SA-2025-2622

software: ghostscript 9.54.0 OS: ROSA-CHROME packageevrstring: ghostscript-9.54.0-11 CVE-ID: CVE-2023-38559 BDU-ID: 2023-07662 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the devnpcxwriterle function of the base/gdevdevdevn.c component of the Ghostscript document processing software suite...

Advisory ROSA-SA-2025-2621

software: xerces-j2 2.12.0 WASP: ROSA-CHROME packageevrstring: xerces-j2-2.12.0-4 CVE-ID: CVE-2022-23437 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Apache Xerces Java XercesJ XML parser causes it to hang in an infinite loop when processing specially crafted XML documents...

Advisory ROSA-SA-2025-2617

software: openssl 1.1.1w OS: ROSA-CHROME packageevrstring: openssl-1.1.1.1w-3 CVE-ID: CVE-2023-5678 BDU-ID: 2023-08615 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the DHgeneratekey function of the OpenSSL library is related to the generation of excessively long X9.42 DH keys. Exploitation of t...

Advisory ROSA-SA-2025-2611

software: coreutils 8.32 OS: ROSA-CHROME packageevrstring: coreutils-8.32-5 CVE-ID: CVE-2024-0684 BDU-ID: 2024-00722 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the linebytessplit function src/split.c of the GNU Core Utilities GNU Coreutils suite of system utilities is related to a buffer...

Advisory ROSA-SA-2025-2607

software: gnutls 3.8.4 OS: ROSA-CHROME packageevrstring: gnutls-3.8.4-1 CVE-ID: CVE-2024-0553 BDU-ID: 2024-00707 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the GnuTLS transport layer cryptographic library is related to a difference in response time when processing an RSA ciphertext in a...

Advisory ROSA-SA-2025-2602

software: glib2.0 2.72.3 OS: ROSA-CHROME packageevrstring: glib2.0-2.72.3-2 CVE-ID: CVE-2023-32665 BDU-ID: 2023-07655 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Glib library is related to the recovery of invalid data in memory. Exploitation of the vulnerability could allow an attacker to...

Advisory ROSA-SA-2025-2596

software: procps-ng 3.3.17 OS: ROSA-CHROME packageevrstring: procps-ng-3.3.17-4 CVE-ID: CVE-2023-4016 BDU-ID: 2023-07117 CVE-Crit: LOW CVE-DESC.: A vulnerability in the running processes information collection utility ps of the procps-ng command line utility set is related to an operation exceedi...

Advisory ROSA-SA-2025-2594

software: freerdp 2.11.7 OS: ROSA-CHROME packageevrstring: freerdp-2.11.7-1 CVE-ID: CVE-2024-22211 BDU-ID: 2024-00706 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the freerdpbitmapplanarcontextreset function of the FreeRDP RDP client is related to an integer overflow when processing the...

Advisory ROSA-SA-2025-2593

software: qpdf 11.9.1 OS: ROSA-CHROME packageevrstring: qpdf-11.9.1-1 CVE-ID: CVE-2024-24246 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A heap buffer overflow vulnerability in qpdf allows attackers to cause application crashes via the std::sharedcount function in sharedptrbase.h. CVE-STATUS: The...

Advisory ROSA-SA-2025-2583

Software: libarchive 3.6.2 OS: ROSA-CHROME packageevrstring: libarchive-3.6.2 CVE-ID: CVE-2024-48957 BDU-ID: 2024-09446 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the executefilteraudio function of the archivereadsupportformatrar.c component of the Libarchive archiving library is related to...

Advisory ROSA-SA-2025-2582

software: libtiff 4.1.0 OS: ROSA-CHROME packageevrstring: libtiff-4.1.0-8 CVE-ID: CVE-2024-7006 BDU-ID: 2024-06610 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the LibTIFF library involves null pointer dereferencing via tifdirinfo.c. Exploitation of the vulnerability could allow an attacker...

Advisory ROSA-SA-2025-2574

software: libsndfile 1.1.0 OS: ROSA-CHROME packageevrstring: libsndfile-1.1.0-4 CVE-ID: CVE-2024-50612 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Vulnerability in libsndfile library: read outside array in oggvorbis.c. CVE-STATUS: The vulnerability has been resolved CVE-REV: To close the...

Advisory ROSA-SA-2025-2560

Software: squid 3.5.20 OS: rosa-server79 packageevrstring: squid-3.5.20-17.0.5.res7.10 CVE-ID: CVE-2024-45802 BDU-ID: 2024-08860 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Squid proxy server is related to input processing errors. Exploitation of the vulnerability could allow an attacker...

Advisory ROSA-SA-2025-2553

Software: rsync 3.1.2 OS: rosa-server79 packageevrstring: rsync-3.1.2-12.0.1.res7 CVE-ID: CVE-2017-16548 BDU-ID: 2021-01395 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the receivexattr function in xattrs.c of the Rsync file transfer and synchronization utility is related to the lack of a check f...

Advisory ROSA-SA-2025-2551

Software: openssh 7.4p1 OS: rosa-server79 packageevrstring: openssh-7.4p1-23.0.6.res7 CVE-ID: CVE-2018-20685 BDU-ID: 2019-00773 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the OpenSSH cryptographic security tool is caused by errors in the validation of the scp.c directory name in the scp clien...

Advisory ROSA-SA-2025-2550

Software: openldap 2.4.44 OS: rosa-server79 packageevrstring: openldap-2.4.44-25.0.2.res7 CVE-ID: CVE-2019-13057 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in OpenLDAP allows a server administrator with rootDN privileges to request authorization as another user from a different...

Advisory ROSA-SA-2025-2549

Software: ghostscript 9.25 OS: rosa-server79 packageevrstring: ghostscript-9.25-5.0.3.res7 CVE-ID: CVE-2018-19478 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Artifex Ghostscript allows an attacker to run a lengthy calculation when processing a PDF file. CVE-STATUS: The vulnerabili...

Advisory ROSA-SA-2024-2546

software: tinyxml 2.6.2 OS: ROSA-CHROME packageevrstring: tinyxml-2.6.2-8 CVE-ID: CVE-2021-42260 BDU-ID: 2022-06895 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the TiXmlParsingData::Stamp function of the tinyxmlParser.cpp component of the TinyXML XML parser is related to the execution of a loop...