libjpeg-turbo: Fix of 2 CVEs

CVE-2020-13790: fix heap buffer over-read in rdppm.c with a crafted binary PPM/PGM file with upstream 6709e4a0 and 1e81b0c3: range-check text PPM/PGM samples and 16-bit binary words against maxval; also CVE-2016-3616, CVE-2018-11213, CVE-2018-11214 - CVE-2020-17541: fix stack buffer overflow in...

cups: Fix of 2 CVEs

CVE-2026-55480: open temporary PPD files with OEXCL and ONOFOLLOW - CVE-2026-61702: reject invalid attributes-natural-language values...

net-snmp: Fix of 4 CVEs

CVE-2018-18066: NULL pointer dereference in snmpd table helper on GetNext - CVE-2022-24805: out-of-bounds access via the NET-SNMP-VACM-MIB index - CVE-2022-24810: NULL pointer dereference on SET to nsVacmAccessTable - CVE-2025-68615: out-of-bounds trapOid access in snmptrapd...

gdb: Fix of CVE-2026-13732

CVE-2026-13732: fix out-of-bounds write in the STABS reader readmemberfunctions...

expat: Fix of 2 CVEs

CVE-2026-117610: NULL pointer dereference in externalEntityInitProcessor2 on initial empty non-final subparser input - CVE-2026-118370: signed integer overflow of attIndex/nPrefixes in storeAtts...

ghostscript: Fix of 8 CVEs

CVE-2018-10194: pdfwrite: guard against writing an infinite text distance - CVE-2018-15909: hide .shfill and type-check shading parameters - CVE-2018-15910: iparam: do not write through an uninitialised result pointer - CVE-2018-15911: AES: reject invalid key lengths before use - CVE-2018-16511:...

libX11: Fix of CVE-2026-88806

CVE-2026-88806: check key action ranges in XkbReadKeyActions...

bind: Fix of 2 CVEs

CVE-2026-11721: Reject RRSIG records whose labels field is below the signer name's label count; do not sign out-of-zone records in dnssec-signzone - CVE-2026-13204: Keep NOQNAME proof selection consistent between validation and caching, and stop asserting when no signed proof is found...

glibc: Fix of CVE-2026-84243

CVE-2026-84243: gettext loads message catalogs from arbitrary paths via LANGUAGE directory traversal...

sqlite: Fix of CVE-2026-119378

CVE-2026-119378: avoid a use-after-free in the R-Tree extension when a manipulated shadow node table makes inserts report rowid 0...

libcap: Fix of 2 CVEs

CVE-2023-2603: fix integer overflow in libcapstrdup - CVE-2026-4878: fix race between path check and xattr update in capsetfile...

rsync: Fix of 2 CVEs

CVE-2026-70456: make room for the trailing NULL in readargs so a crafted daemon argument list cannot write one slot past the argv allocation - CVE-2026-53785: create the implied parent directories of a --relative transfer without following a symlinked parent component on any non-sender receiver,...

openvpn: Fix of CVE-2024-5594

CVE-2024-5594: fix injection of arbitrary data into client logs via control channel messages with embedded NUL or non-printable characters...

rsync: Fix of 2 CVEs

CVE-2026-29518: re-implement the "use chroot = no" confinement after the centos7els fix: every path operation proves its parent directory beneath the pinned module root through /proc/self/fd and runs on it with the at calls. In-module symlinks, directories the daemon uid may search but not read,...

ca-certificates: Fix of CVE-2026-114406

Comodo AAA Services root AAA Certificate Services is no longer trusted for TLS server authentication through the legacy bundle: it issued the Sectigo cross-signs of the compromised eMudhra intermediates Mozilla bug 2083449. Its legacy e-mail and code-signing trust is kept...

unzip: Fix of CVE-2018-1000035

CVE-2018-1000035: heap-based buffer overflow in UzpPassword password prompt...

e2fsprogs: Fix of CVE-2022-1304

CVE-2022-1304: libext2fs: add sanity check to extent manipulation...

xz: Fix of CVE-2022-1271

CVE-2022-1271: xzgrep: fix arbitrary file write and command execution via crafted filenames...

json-c: Fix of CVE-2020-12762

CVE-2020-12762: Fix integer overflows and out-of-bounds write in printbuf and linkhash with large inputs...

squid34: Fix of 3 CVEs

CVE-2026-47729: fix out-of-bounds read in FTP directory listing parsing when a TypeA/TypeB date is not followed by a filename - CVE-2026-50012: harden peerDigestSwapInMask against a cache digest reply whose on-the-wire size exceeds the declared masksize heap buffer overflow...

cpio: Fix of 2 CVEs

CVE-2019-14866: check for overflow of tar header fields when creating archives - CVE-2021-38185: fix integer overflow in dynamic string handling...

sendmail: Fix of CVE-2021-3618

CVE-2021-3618: HTTP commands accepted after STARTTLS ALPACA cross-protocol attack...

libgcrypt: Fix of CVE-2021-33560

CVE-2014-3591: use ciphertext blinding for Elgamal decryption prerequisite for CVE-2021-33560 - CVE-2021-33560: add exponent blinding to Elgamal decryption to mitigate side-channel attack on mpipowm, and always use a full-size ephemeral k in Elgamal encryption...

giflib: Fix of 3 CVEs

CVE-2020-23922: heap-based buffer over-read in DumpScreen2RGB in gif2rgb - CVE-2023-48161: heap buffer overflow in DumpScreen2RGB in gif2rgb - CVE-2026-23868: double-free in MakeSavedImage on allocation failure...

unbound: Fix of 14 CVEs

CVE-2026-42959: use the correct counter when collecting ADDITIONAL rrsets for validation - CVE-2026-42960: only mark in-bailiwick NS glue in the authority section as glue - CVE-2026-81634: count the owner name in the canonical rrset size check - CVE-2026-81642: check buffer bounds when...

icu: Fix of CVE-2025-5222

CVE-2025-5222: fix stack buffer overflow in genrb with overlong table keys...

patch: Fix of CVE-2018-6952

CVE-2018-6952: double free in anotherhunk via pchswap...

python-setuptools: Fix of 2 CVEs

CVE-2022-40897: ReDoS in packageindex REL regex - CVE-2024-6345: command injection via svn URLs in packageindex...

rpm: Fix of CVE-2021-20271

CVE-2021-20271: signature check bypass via corrupted package header...

bind: Fix of 2 CVEs

CVE-2026-94300: Serialize access to the shared GSS-TSIG security context memory corruption on concurrent or replayed GSS-TSIG traffic - CVE-2026-19630: Bound how many compression pointers a name and a message may make named follow CPU exhaustion on crafted messages...

c-ares: Fix of 3 CVEs

CVE-2022-4904: fix stack overflow in aressetsortlist due to missing input validation - CVE-2023-32067: fix denial of service via 0-byte UDP payload - CVE-2016-5180: fix heap-based buffer overflow in arescreatequery...

expat: Fix of CVE-2026-77214

CVE-2026-77214: reject XMLParseBuffer lengths larger than the space left in the internal buffer...

cups: Fix of CVE-2026-55453

CVE-2026-55453: fix PPD keyword injection by replacing control characters in IPP strings backends report to cupsd, and drop special PPD keywords...

libpng: Fix of 3 CVEs

CVE-2016-10087: fix NULL pointer dereference in pngsettext2 - CVE-2026-25646: fix heap buffer overflow in pngsetdither - CVE-2026-33416: fix use-after-free on pngptr palette and trans buffers...

kernel: Fix of 32 CVEs

s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block CVE-2026-98399 - USB: serial: ioti: fix heap overflow in buildi2cfwhdr CVE-2026-53195 - hwrng: geode - Fix PCI device refcount leak CVE-2022-50659 - ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput CVE-2026-80829 - ubi: Fix...

php: Fix of 6 CVEs

CVE-2026-109618: avoid heap state corruption via bailout on out-of-memory - CVE-2026-109619: reset per-request globals that could be reused after a bailout during request startup...

rsync: Fix of 2 CVEs

CVE-2026-53783: harden the support/rrsync wrapper: refuse paths that resolve outside the restricted directory, refuse -L/-k/-K and --copy-unsafe-links there, hand the transfer arguments and the receiver's directory options to rsync as held directories, stop path arguments being parsed as options,...

vim: Fix of 2 CVEs

CVE-2026-73073: fix command injection via a crafted typename in ccomplete.vim omni completion upstream 9.2.0845 - CVE-2026-43961: fix command injection via a crafted filename in netrw marked-file handling upstream 9.2.0480...

libevent: Fix of 6 CVEs

CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing...

Update of ca-certificates

update to CKBI 2.92 from NSS 3.131.1 - updated certificates: - Certificate "OISTE Server Root RSA G1" - Certificate "Amazon Root CA 1" - Certificate "Amazon Root CA 2" - Certificate "Amazon Root CA 3" - Certificate "Amazon Root CA 4" - Certificate "GlobalSign ECC Root CA - R4" - Certificate "GTS...

libarchive: Fix of 2 CVEs

CVE-2021-23177: fix extraction of ACLs to the symlink target instead of the link - CVE-2021-31566: do not follow symlinks when fixing up permissions and file flags - CVE-2026-5121: validate pzlog2bs in the iso9660 zisofs reader...

python: Fix of CVE-2026-6100

CVE-2026-6100: fix a use-after-free in the bz2 and zlib modules when a decompressor object is reused after a MemoryError; the input pointer to the released caller buffer is no longer kept, so a later decompressobj.flush as done by gzip.GzipFile at EOF cannot read it...

ncurses: Fix of 2 CVEs

CVE-2021-39537: fix heap buffer overflow in nccaptoinfo with a crafted termcap entry - CVE-2023-29491: ignore terminfo/termcap environment variables in setuid/setgid programs --disable-root-environ...

kernel: Fix of CVE-2026-89861

ALSA: usb-audio: Fix out of bounds reads when finding clock sources CVE-2024-53150 - scsi: qla2xxx: Hold vport reference in qla24xxreportidacquisition CVE-2026-89861...

freetype: Fix of 2 CVEs

CVE-2022-27405: Fix segmentation violation via FNTSizeRequest - CVE-2022-27406: Fix segmentation violation via FTRequestSize...

libtiff: Fix of 22 CVEs

CVE-2018-16335: validate file size before chopping up a single strip...

libX11: Fix of 6 CVEs

CVE-2018-14599: fix off-by-one writes in XListExtensions, XGetFontPath and XListFonts - CVE-2018-14600: fix out-of-bounds write in XListExtensions and XGetFontPath - CVE-2018-14598: fix crash on invalid reply in XListExtensions and XGetFontPath - CVE-2021-31535: reject strings longer than...

kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...

kernel: Fix of 9 CVEs

mISDN: fix use-after-free bugs in l1oip timer handlers CVE-2022-3565 - media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - Bluetooth: btsdio: fix use after free bug in btsdioremove due to unfinished work CVE-2023-1989 - proc: procskipspaces shouldn't think it is working on C...

squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...