Advisory ROSA-SA-2025-2658

software: tidy 5.7.28 WASP: ROSA-CHROME packageevrstring: tidy-5.7.28-2 CVE-ID: CVE-2021-33391 BDU-ID: None CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in HTML Tidy's HTACG allows an attacker to execute arbitrary code via the -g option of the CleanNode function in gdoc.c. CVE-STATUS: The...

Advisory ROSA-SA-2025-2649

software: jasper 2.0.32 WASP: ROSA-CHROME packageevrstring: jasper-2.0.32 CVE-ID: CVE-2023-51257 BDU-ID: 2024-00902 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the jasimagedecode function of the JasPer library set's JPC encoder is related to an operation exceeding buffer boundaries in memory...

Advisory ROSA-SA-2025-2637

software: glibc 2.33 AXIS: ROSA-CHROME packageevrstring: glibc-2.33-10.git1a2009.2 CVE-ID: CVE-2023-4806 BDU-ID: 2024-00852 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the getaddrinfo function of the GNU C library glibc is related to memory usage after it has been freed. Exploitation of the...

Advisory ROSA-SA-2025-2626

software: leptonica 1.82.0 WASP: ROSA-CHROME packageevrstring: leptonica-1.82.0-1 CVE-ID: CVE-2020-36277 BDU-ID: 2021-05306 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Leptonica image processing library involves the implementation of an incorrect control flow. Exploitation of the...

Advisory ROSA-SA-2025-2624

software: libxml2 2.9.14 OS: ROSA-CHROME packageevrstring: libxml2-2.9.14-6 CVE-ID: CVE-2024-25062 BDU-ID: 2024-01415 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the xmlValidatePopElement function of the XML Reader Interface component of the Libxml2 library is related to memory usage after it is...

CVE-2024-50195 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50195 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

Advisory ROSA-SA-2025-2596

software: procps-ng 3.3.17 OS: ROSA-CHROME packageevrstring: procps-ng-3.3.17-4 CVE-ID: CVE-2023-4016 BDU-ID: 2023-07117 CVE-Crit: LOW CVE-DESC.: A vulnerability in the running processes information collection utility ps of the procps-ng command line utility set is related to an operation exceedi...

Advisory ROSA-SA-2025-2595

software: squid 5.9 WASP: ROSA-CHROME packageevrstring: squid-5.9-5 CVE-ID: CVE-2024-23638 BDU-ID: 2024-00895 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the Squid proxy server is related to the dereferencing of an expired pointer. Exploitation of the vulnerability could allow an attacker...

Advisory ROSA-SA-2025-2590

software: vim 9.1.0754 WASP: ROSA-CHROME packageevrstring: vim-9.1.0754-1 CVE-ID: CVE-2024-41957 BDU-ID: 2024-06478 CVE-Crit: LOW CVE-DESC.: A vulnerability in the tagstackclearentry function of the src/alloc.c file of the vim text editor exists due to a bug in the use of pointers after memory...

Advisory ROSA-SA-2025-2589

software: postgresql 12.20 WASP: ROSA-CHROME packageevrstring: postgresql-12.20-1 CVE-ID: CVE-2024-7348 BDU-ID: 2024-06153 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pgdump utility of the PostgreSQL database management system is related to the dereferencing of a null pointer due to...

Advisory ROSA-SA-2025-2586

software: nano 8.2 OS: ROSA-CHROME packageevrstring: nano-8.2-3 CVE-ID: CVE-2024-5742 BDU-ID: 2024-06879 CVE-Crit: LOW CVE-DESC.: A vulnerability in the Nano text editor is related to temporary file handling errors. Exploitation of the vulnerability could allow an attacker to impact data integrit...

Advisory ROSA-SA-2025-2581

software: opensc 0.23.0 OS: ROSA-CHROME packageevrstring: opensc-0.23.0-4 CVE-ID: CVE-2024-1454 BDU-ID: 2024-03243 CVE-Crit: LOW CVE-DESC.: A vulnerability in the AuthentIC driver of the OpenSC smart card software toolkit and libraries is related to memory usage after it has been freed...

Advisory ROSA-SA-2025-2580

software: opensc 0.23.0 OS: ROSA-CHROME packageevrstring: opensc-0.23.0-2 CVE-ID: CVE-2023-40660 BDU-ID: 2024-02589 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the OpenSC smart card software toolkit and libraries is related to the fact that token/card authentication by one process can perform...

Advisory ROSA-SA-2025-2578

software: suricata 6.0.20 WASP: ROSA-CHROME packageevrstring: suricata-6.0.20-1 CVE-ID: CVE-2024-38535 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Vulnerability in Suricata parsing HTTP/2 traffic. CVE-STATUS: Vulnerability has been resolved. CVE-REV: To close the vulnerability, run the command: dnf...

Advisory ROSA-SA-2025-2575

software: x11-server 1.20.14 OS: ROSA-CHROME packageevrstring: x11-server-1.20.14-11 CVE-ID: CVE-2024-9632 BDU-ID: 2024-09084 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the XkbSetCompatMap function of the X Window System X.Org Server implementation is related to a buffer overflow in dynamic...

Advisory ROSA-SA-2025-2572

software: squid 5.10 OS: ROSA-CHROME packageevrstring: squid-5.10-1 CVE-ID: CVE-2024-45802 BDU-ID: 2024-08860 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Squid proxy server is related to input processing errors. Exploitation of the vulnerability could allow an attacker acting remotely to cau...

CVE-2025-21664

In the Linux kernel, the following vulnerability has been resolved: dm thin: make getfirstthin use rcu-safe list first function The documentation in rculist.h explains the absence of listemptyrcu and cautions programmers against relying on a listempty - listfirst sequence in RCU safe code. This i...

CVE-2025-21659

In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI...

CVE-2024-57937

In the Linux kernel, the following vulnerability has been resolved: mm: reinstate ability to map write-sealed memfd mappings read-only Patch series "mm: reinstate ability to map write-sealed memfd mappings read-only". In commit 158978945f31 "mm: perform the mappingmapwritable check after callmmap...

CVE-2025-21661 gpio: virtuser: fix missing lookup table cleanups

In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents subsequent probe attempts from...