bash: Fix of CVE-2019-9924

CVE-2019-9924: reject attempts to add pathnames containing slashes to the hash table in restricted shell...

squid: Fix of 3 CVEs

CVE-2019-12521: fix ESI parser off-by-one heap overflow by enforcing a stack-depth limit and throwing on overflow - CVE-2019-12524 already addressed by the CVE-2019-12520 backport same fix upstream; see Squid advisory SQUID-2019:4...

binutils: Fix of CVE-2025-11082

CVE-2025-11082: fix heap-based buffer overflow in bfdelfparseehframe...

expat: Fix of CVE-2026-25210

CVE-2026-25210: fix memory corruption via integer overflow in doContent function during tag buffer reallocation...

vim: Fix of CVE-2026-26269

CVE-2026-26269: fix stack-based buffer overflow in NetBeans integration that could lead to a crash or arbitrary code execution via a malicious server...

binutils: Fix of CVE-2017-9042

CVE-2017-9042: readelf.c fix a possible application crash known as the "cannot be represented in type long" issue...

tomcat6: Fix of CVE-2025-24813

CVE-2025-24813: enhance lifecycle of temporary files used by partial PUT...

rsync: Fix of CVE-2024-12088

CVE-2024-12088: fix improper verification of symbolic link destinations to prevent path traversal vulnerability...

Update of kernel-firmware, kernel-abi-whitelists, kernel-doc

KB-127: Bump version separete fw build...

Update of kernel-abi-whitelists, kernel-firmware, kernel-doc

...

Update of bind-sdb, bind-libs, bind-devel, bind, bind-utils, bind-chroot

...

squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

libssh2: Fix of CVE-2026-66032

CVE-2026-66032: nullify data after free in sftpopen to prevent a double-free when sftppacketrequire fails on the FXPSTATUS/FXOK path...

ImageMagick: Fix of 2 CVEs

CVE-2026-33901: add MVG push clip-path/gradient/pattern bounds check in DrawImage to prevent out-of-bounds read - CVE-2026-33908: bound DestroyXMLTree recursion depth to prevent stack exhaustion on deeply nested XML...

curl: Fix of 2 CVEs

CVE-2018-1000120: fix buffer overflow exists in the FTP URL handling - CVE-2018-1000007: fix leak authentication data to third parties in HTTP requests...

python: Fix of CVE-2017-1000158

CVE-2017-1000158: fix integer overflow in PyStringDecodeEscape that could trigger a heap-based buffer overflow when decoding very large byte strings...

perl: Fix of CVE-2018-12015

CVE-2018-12015: Archive::Tar path traversal — remove existing block-device or out-of-CWD symlink targets before overwriting during extraction...

python: Fix of CVE-2019-9948

CVE-2019-9948: fix urllib localfile:// URL scheme bypass that allowed file reads when localfile handler was defined...

haproxy: Fix of CVE-2019-18277

CVE-2019-18277: reject messages where "chunked" is missing from transfer-encoding...

python: Fix of CVE-2025-8194

CVE-2025-8194: tarfile now validates archives to ensure member offsets are non-negative...

Update of microcode_ctl

Update Intel CPU microcode to 20251111: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000410; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000650; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

kernel: Fix of 6 CVEs

fix: virtio-net: Add validation for used length CVE-2021-47352 - xen/netfront: don't use gnttabqueryforeignaccess for mapped status CVE-2022-23037 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - net: fix information leakage in /proc/net/ptype CVE-2022-48757 - net: atm:...

kernel: Fix of CVE-2023-52572

cifs: Fix UAF in cifsdemultiplexthread CVE-2023-52572...

binutils: Fix of CVE-2025-0840

CVE-2025-0840: fix stack-buffer-overflow at objdump disassemblebytes...

Update of microcode_ctl

Fix silent microcode rejection in some cases - Loading to /dev/null is enabled on VM...

Update of microcode_ctl

Update Intel CPU microcode to microcode-20220207 release: - Fixes in releasenote.md file...

Update of bind-sdb, bind-libs, bind-devel, bind, bind-utils, bind-chroot

...

cups: Fix of CVE-2025-58060

CVE-2025-58060: fix authentication bypass in the scheduler by blocking authentication attempts using a method other than the configured AuthType...

gzip: Fix of CVE-2026-41992

CVE-2026-41992: out-of-bounds read in the LZH decoder from stale shared decompression state left/right reused across a .Z then .lzh file in a single gzip -d invocation...

vim: Fix of CVE-2026-55892

CVE-2026-55892: fix out-of-bounds write in dumpprefixes...

httpd: Fix of 2 CVEs

CVE-2026-29170: modproxyftp: XSS in generated HTML directory listing; escape entry names with apescapehtmlaposescapepath instead of apescapeuri in href attributes - CVE-2026-42535: moddavfs: deny WebDAV access to or within the DAVFSSTATEDIR state directory to prevent manipulation of trusted...

httpd: Fix of CVE-2025-58098

CVE-2025-58098: modcgid with SSI exec cmd passed the shell-escaped query string as extra arguments to the executed shell command; do not pass r-args for SSI requests...

bind: Fix of CVE-2025-40778

CVE-2025-40778: Tighten restrictions on caching NS RRsets in the authority section require the NS owner name to be an ancestor of the queried name to prevent cache poisoning via spoofed records...

cups: Fix of CVE-2026-27447

CVE-2026-27447: fix authorization bypass via case-insensitive username comparison in scheduler...

vim: Fix of CVE-2026-39881

CVE-2026-39881: fix command injection in netbeans interface by validating defineAnnoType typeName/fg/bg and specialKeys tokens against an allowlist of safe characters before interpolating them into Ex commands...

mysql: Fix of CVE-2018-2755

CVE-2018-2755: harden binlog event decoding against corrupt binary log files BUG24365972...

python: Fix of 2 CVEs

CVE-2018-1060: fix catastrophic backtracking in APOP method, prevent denial of service, add input validation and enforce backtracking limits - CVE-2018-1061: fix catastrophic backtracking in the difflib.ISLINEJUNK method...

samba: Fix of CVE-2020-25717

CVE-2020-25717: Adapt CVE's patch to Centos 6 based systems where regular user id starts from 500, so change the default value of the new config parameters added: "min domain uid" to 500...

clamav: Fix of 8 CVEs

Update to 1.0.9 LTS version - CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser - CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser - CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems...

git: Fix of CVE-2025-46835

CVE-2025-46835: fix vulnerability where Git GUI can create and overwrite arbitrary writable files...

Update of nss

update to CKBI 2.74 from NSS 3.110 - updated certificates: - Certificate "certSIGN ROOT CA" - Certificate "ACCVRAIZ1" - Certificate "Entrust Root Certification Authority - G4" - Certificate "Security Communication ECC RootCA1" - Certificate "BJCA Global Root CA1" - Certificate "BJCA Global Root...

kernel: Fix of 4 CVEs

media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccoreinit CVE-2022-49478 - x86/kvm: Disable kvmclock on all CPUs on shutdown CVE-2021-47110 - cifs: fix potential double free during failed mount CVE-2022-49541 - drm/amd/pm: fix double free in siparsepowertable CVE-2022-49530...

ntp: Fix of CVE-2020-13817

CVE-2020-13817: randomize transmit timestamp in client requests...

Update of bind-devel, bind-chroot, bind-libs, bind, bind-libs, bind-utils, bind-devel, bind-sdb

...

rsync: Fix of 6 CVEs

CVE-2026-53784: confine the daemon's absolute chdir target with a new ownership-walk resolver so a planted parent symlink cannot steer a "use chroot = no" module root outside the module - CVE-2026-53786: strip a real moduledir prefix before the daemon-filter check on a merge-file path -- leaving...

nginx: Fix of CVE-2026-49975

CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...

openssl: Fix of CVE-2026-45447

CVE-2026-45447: fix possible use-after-free in PKCS7verify with empty digestAlgorithms SET...

ImageMagick: Fix of CVE-2026-30883

CVE-2026-30883: fix heap overflow when encoding PNG with oversized profile...

file: Fix of CVE-2019-18218

CVE-2019-18218: fix heap-based buffer overflow in cdfreadpropertyinfo...

zsh: Fix of 3 CVEs

CVE-2018-1071: check bounds when copying path in hashcmd - CVE-2018-7549: avoid crash copying empty hash table - CVE-2018-13259: fix shebang line truncation in zexecve...