601 matches found
freetype: Fix of 2 CVEs
CVE-2022-27405: Fix segmentation violation via FNTSizeRequest - CVE-2022-27406: Fix segmentation violation via FTRequestSize...
libtiff: Fix of 22 CVEs
CVE-2018-16335: validate file size before chopping up a single strip...
libX11: Fix of 6 CVEs
CVE-2018-14599: fix off-by-one writes in XListExtensions, XGetFontPath and XListFonts - CVE-2018-14600: fix out-of-bounds write in XListExtensions and XGetFontPath - CVE-2018-14598: fix crash on invalid reply in XListExtensions and XGetFontPath - CVE-2021-31535: reject strings longer than...
kernel: Fix of 39 CVEs
nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...
php: Fix of 2 CVEs
CVE-2026-109618: avoid heap state corruption via bailout on out-of-memory - CVE-2026-109619: reset per-request globals that could be reused after a bailout during request startup...
kernel: Fix of 9 CVEs
mISDN: fix use-after-free bugs in l1oip timer handlers CVE-2022-3565 - media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - Bluetooth: btsdio: fix use after free bug in btsdioremove due to unfinished work CVE-2023-1989 - proc: procskipspaces shouldn't think it is working on C...
squid: Fix of 13 CVEs
CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...
kernel: Fix of 9 CVEs
rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 - xfs: fix freemap adjustments when adding xattrs to leaf blocks CVE-2026-43158 - xfs: delete attr leaf freemap entries when empty CVE-2026-43158 - ALSA: 6fire: fix use-after-free on disconnect CVE-2026-31581 - brcmfmac:...
Update of tzdata
Upgrade to tzdata-2026e - Manitoba moves to permanent -05 on 2026-10-31. - Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. - Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. - Fix security, performance and porting bugs in zic and localtime. - Alberta moved...
gawk: Fix of 3 CVEs
CVE-2023-4156: builtin.c formattree: when collecting positional field widths or precisions, check for wrap around to negative values - CVE-2026-40469: builtin.c subcommon: check for overflow in the result buffer size calculation using 64-bit math, failing with a fatal error instead of corrupting...
apr-util: Fix of 2 CVEs
CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem...
libxslt: Fix of 6 CVEs
CVE-2019-11068: fix security framework bypass in xsltCheckRead and xsltCheckWrite callers - CVE-2019-18197: fix dangling pointer in xsltCopyText - CVE-2019-5815: always set context node before calling XPath iterators - CVE-2021-30560: fix use-after-free in xsltApplyTemplates - CVE-2024-55549: fix...
php: Fix of 13 CVEs
CVE-2026-7260: fix stack exhaustion via unbounded recursion on circular symlinks in phar archives - CVE-2026-9672: fix use of uninitialised LZW table data in bundled libgd GIF decoder...
kernel: Fix of 12 CVEs
drm/vmwgfx: Fix invalid reads in fence signaled events CVE-2024-36960 - afunix: Fix garbage collector racing against connect CVE-2024-26923 - ipv6: remove maxsize check inline with ipv4 CVE-2023-52340 - aoe: fix the potential use-after-free problem in aoecmdcfgpkts CVE-2023-6270 - smb: client:...
kernel: Fix of 42 CVEs
Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...
kernel: Fix of 7 CVEs
KVM: nSVM: avoid picking up unsupported bits from L2 in intctl CVE-2021-3653 CVE-2021-3653 - xen/netfront: fix leaking data in shared pages CVE-2022-33740 - xfs: fix up non-directory creation in SGID directories CVE-2021-4037 - netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 -...
kernel: Fix of 16 CVEs
Bluetooth: L2CAP: Fix use-after-free in l2capsockreadycb CVE-2023-40283 - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet CVE-2023-6932 - smb: client: fix OOB in smbCalcSize CVE-2023-6606 - net/sched: schhfsc: Ensure inner classes have fsc curve CVE-2023-4623 - net/sched: clsfw:...
kernel: Fix of 31 CVEs
ipv4: validate checksumstart before completing checksum CVE-2026-99999 - fbdev: serialize mode sysfs access with lockfbinfo CVE-2026-80785 - powerpc/rtas: avoid device tree lookups in rtasosterm CVE-2022-50870 - svcrdma: Reject connection when transport allocation fails CVE-2026-89531 -...
rsync: Fix of CVE-2026-43619
CVE-2026-29518: re-implement the "use chroot = no" confinement after the centos7els fix: every path operation proves its parent directory beneath the pinned module root through /proc/self/fd and runs on it with the at calls. In-module symlinks, directories the daemon uid may search but not read,...
cups: Fix of 2 CVEs
CVE-2026-107885: fix denial of service by not letting an in-flight Send-Document suppress submission timeouts of unrelated held jobs beyond MultipleOperationTimeout - CVE-2026-107890: fix cupsd NULL pointer dereference caused by repeated IPP group tags in job creation requests...
kernel: Fix of 69 CVEs
sctp: fix errchunk memory leaks in INIT handling CVE-2026-72413 - ACPICA: Fix use-after-free in acpidsterminatecontrolmethod CVE-2026-97455 - ACPICA: Enhance buffer validation in acpiutwalkamlresources CVE-2026-97445 - Bluetooth: L2CAP: validate connectionless PSM length CVE-2026-97408 - wifi:...
openssl: Fix of CVE-2026-84782
CVE-2026-84782: reset initoff before a DTLS retransmission and skip retransmitting while a handshake write is still suspended...
openssh: Fix of 4 CVEs
CVE-2026-106555: reset GSSAPI client state before each authentication attempt - CVE-2026-106553: store GSSAPI delegated credentials only after successful GSSAPI authentication - CVE-2026-106583: disallow '$' and '' in command-line user names - CVE-2026-106585: reject compressed packets that...
rsync: Fix of 4 CVEs
CVE-2026-53801: prevent the sender from listing a directory outside the transfer through a path component swapped for a symlink - CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way - CVE-2026-53800: prevent --remove-source-files from deleting a file outside...
libssh2: Fix of 3 CVEs
CVE-2019-3860: bounds-check SFTP packet sizes in sftppacketrequire/v and sftpbin2attr - CVE-2019-3861: bounds-check paddinglength in libssh2transportread...
rsync: Fix of 6 CVEs
CVE-2026-53784: confine the daemon's absolute chdir target with a new ownership-walk resolver so a planted parent symlink cannot steer a "use chroot = no" module root outside the module - CVE-2026-53786: strip a real moduledir prefix before the daemon-filter check on a merge-file path -- leaving...
httpd: Fix of CVE-2026-63292
CVE-2026-63292: modvhostalias: stack buffer overflow when a single Host header segment exceeds HUGESTRINGLEN; reject the expansion...
httpd: Fix of CVE-2026-56154
CVE-2026-56154: modrewrite: use-after-free of the Vary header name collected during an LA-U/LA-F lookahead of an HTTP header; copy it into the main request pool before destroying the sub-request...
rsync: Fix of 5 CVEs
CVE-2026-53790: refuse a shell-active RSYNCCONNECTPROG %H host and quote it; escape backtick, newline and carriage return in remote-shell arguments - CVE-2026-53793: confine a "/./" inner-module chroot: secure opens, changedir, chmod, rename, delta-basis opens and alt-dest basis stats, resolved...
vim: Fix of 3 CVEs
CVE-2026-73072: fix heap buffer overflow in setsofo with a crafted spell file upstream 9.2.0846 - CVE-2026-73076: fix arbitrary command execution via a crafted .VimballRecord vimball member upstream 9.2.0847 - CVE-2026-73078: fix Ex command injection via crafted netrw bookmark/history menu...
nginx: Fix of 5 CVEs
CVE-2026-27651: properly clear s-passwd in mail auth http requests to fix a null pointer dereference on CRAM-MD5/APOP retry - CVE-2026-27654: validate the Destination length for Dav COPY and MOVE to prevent an integer underflow and heap buffer overwrite when alias is used - CVE-2026-27654: also...
httpd: Fix of CVE-2026-56153
CVE-2026-56153: modcharsetlite: out-of-bounds write in finishpartialchar when a partial multibyte character straddles buckets; stop filling ctx-buf once it is full...
expat: Fix of 2 CVEs
CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...
mysql: Fix of 3 CVEs
CVE-2017-3636: mysqlaccess no longer loads its configuration file from the current directory BUG25043674 - CVE-2017-3651: mysql client escapes quoted database names in USE BUG25998635 - CVE-2017-10384: reject partition names whose file path exceeds FNREFLEN instead of overflowing stack buffers...
Update of cyrus-sasl
Bump up version...
libxml2: Fix of 2 CVEs
CVE-2026-86143: reject buffer lengths at or above INTMAX before calling the output write callback to prevent an integer overflow - CVE-2026-86144: propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree so parser flags such as XMLPARSENONET are honoured...
java-1.7.0-openjdk: Fix of CVE-2026-47010
CVE-2026-47010: Enhance JPEG handling JDK-8374058, JDK-8388811...
nginx: Fix of CVE-2026-1642
CVE-2026-1642: detect premature plain text response from SSL backend...
python: Fix of CVE-2026-9669
CVE-2026-9669: fix a stack buffer overflow in the bz2 module when a BZ2Decompressor object is reused after a decompression error; the decompressor now becomes unusable once libbz2 reports an error, instead of resuming from an invalid internal state...
kernel: Fix of 56 CVEs
usb: free iso schedules on failed submit CVE-2026-64348 - udf: validate VAT header length against the VAT inode size CVE-2026-64323 - USB: idmouse: fix use-after-free on disconnect race CVE-2026-64344 - USB: ldusb: fix use-after-free on disconnect race CVE-2026-64343 - USB: iowarrior: fix...
gnutls: Fix of CVE-2026-42012
CVE-2026-42012: URI subjectAltName now precludes Common Name fallback in hostname verification...
libxml2: Fix of 3 CVEs
CVE-2026-86138: add overflow checks to xmlDictAddQString pool size calculation and bound the QName lengths in its caller xmlDictQLookup to prevent heap buffer overflow when interning long QNames - CVE-2026-86140: add bounds checks around the englobing parenthesis strcat calls in...
sssd: Fix of CVE-2026-68743
CVE-2026-68743: validate authtokenlength in extractauthtokv1 to prevent an out-of-bounds read in the PAM responder...
expat: Fix of CVE-2026-76957
CVE-2026-76957: fix use-after-free from calling XMLParserFree inside a custom unknown-encoding convert or release callback, by routing both through callUnknownEncodingConvert/callUnknownEncodingRelease so they are covered by the handler call depth tracking...
python: Fix of CVE-2026-0864
CVE-2026-0864: fix configuration injection in the ConfigParser module by normalizing all line endings CR, CRLF and LF to LF+TAB when writing multi-line values, so a carriage return in an attacker-controlled value can no longer inject unexpected keys and values into the written file...
openssl: Fix of CVE-2026-54874
CVE-2026-54874: avoid buffering the whole DTLS read buffer for a record arriving early for the next epoch, capping per-connection memory amplification...
bind: Fix of 2 CVEs
CVE-2026-13321: Reject NSEC records whose next owner name points outside the signer's zone, which let a signed zone forge proofs of non-existence for other zones - CVE-2026-11622: Reference count the cache rdataset headers so a superseded generation is freed as soon as nothing holds it, instead...
python: Fix of 3 CVEs
CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...
java-1.7.0-openjdk: Fix of 11 CVEs
CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...