Update of nss

update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "OISTE WISeKey Global Root GC CA" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma Chambers of...

tomcat6: Fix of CVE-2026-55957

CVE-2026-55957: tomcat6: JNDIRealm GSSAPI authenticated bind allowed authentication without the correct password...

glib2: Fix of 2 CVEs

CVE-2026-58011: out-of-bounds read from an invalid GDateTime produced by gdatetimeaddfull without range validation, later read by gdatetimegetymd - CVE-2026-58013: heap buffer over-read in giochannelreadlinebackend when a multi-byte line terminator is memcmp'd past the end of the buffer...

vim: Fix of CVE-2026-55892

CVE-2026-55892: fix out-of-bounds write in dumpprefixes...

libxml2: Fix of CVE-2026-11979

CVE-2026-11979: add bounds checks in xmlcatalog --shell usershell to prevent stack buffer overflows when parsing overly long command lines...

mysql: Fix of CVE-2018-2755

CVE-2018-2755: harden binlog event decoding against corrupt binary log files BUG24365972...

libxml2: Fix of 2 CVEs

CVE-2018-14404: fix NULL pointer dereference in xmlXPathCompOpEval when AND/OR operator operates on an empty XPath stack - CVE-2019-19956: fix memory leak in xmlParseBalancedChunkMemoryRecover when parsing NULL doc...

python: Fix of CVE-2019-9948

CVE-2019-9948: fix urllib localfile:// URL scheme bypass that allowed file reads when localfile handler was defined...

squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

php: Fix of 5 CVEs

CVE-2019-9023: mbstring oniguruma: fix heap overflow in utf32bembctocode and related mbctocode encoders bug 77418; completes CVE-2019-9023 coverage alongside existing php-5.3.29-bug773707737177381773827738577394.patch - CVE-2019-11034: exif: fix heap-buffer-overflow in phpifdget32s bug 77753 -...

ImageMagick: Fix of 3 CVEs

CVE-2025-66628: fix integer overflow in TIM parser - CVE-2026-28494: fix stack buffer overflow in morphology kernel parsing - CVE-2026-28693: fix integer overflow in DIB coder...

binutils: Fix of 3 CVEs

CVE-2025-66862: fix heap-buffer-overflow in gnuspecial in cplus-dem.c - CVE-2025-66863: fix SEGV in ddiscriminator in cp-demangle.c - CVE-2025-66865: fix stack overflow in dprintcomp in cp-demangle.c...

squid: Fix of CVE-2025-62168

CVE-2025-62168: Fix failure to redact HTTP authentication credentials in error handling to prevent information disclosure...

squid34: Fix of CVE-2025-62168

CVE-2025-62168: Redact HTTP authentication credentials in error handling to prevent information disclosure...

libxml2: Fix of CVE-2022-49043

CVE-2022-49043: fix use-after-free in xmlXIncludeAddNode, free URI after reporting the error to avoid use-after-free...

openssl: Fix of CVE-2018-0734

CVE-2018-0734: fix timing side channel attack in DSA signature algorithm...

openvpn: Fix of CVE-2020-15078

CVE-2020-15078: fix authentication bypass and access to control channel data on servers configured with deferred authentication...

samba: Fix of CVE-2020-25717

CVE-2020-25717: Adapt CVE's patch to Centos 6 based systems where regular user id starts from 500, so change the default value of the new config parameters added: "min domain uid" to 500...

dovecot: Fix of CVE-2020-12674

CVE-2020-12674: fix mishandling of zero length in RPA request to prevent auth service crash...

cups: Fix of CVE-2023-4504

CVE-2023-4504: check for null terminator after a backslash...

spamassassin: Fix of 2 CVEs

CVE-2020-1930: fix command-execution vulnerability in SpamAssassin .cf parsing - CVE-2020-1931: fix command-execution vulnerability in SpamAssassin .cf parsing...

glibc: Fix of CVE-2020-1752

CVE-2020-1752: fix use-after-free vulnerability in glob...

dovecot: Fix of CVE-2020-12673

CVE-2020-12673: fix reading past buffer...

glibc: Fix of CVE-2019-9169

CVE-2019-9169: fix heap-based buffer over-read in proceednextnode in posix/regexec.c...

squid34: Fix of CVE-2025-54574

CVE-2025-54574: fix buffer overflow in URN handling...

git: Fix of CVE-2025-27613

CVE-2025-27613: fix vulnerability where Gitk can write and truncate arbitrary writable files...

libxml2: Fix of 2 CVEs

CVE-2025-49794: fix memory safety issues in xmlSchematronReportOutput when parsing XPath elements - CVE-2025-49796: fix memory corruption issue triggered by processing sch:name elements in input XML file...

perl: Fix of CVE-2018-18311

CVE-2018-18311: fix buffer overflow...

rsync: Fix of CVE-2024-12087

CVE-2024-12087: fix path traversal vulnerability by adding a proper symlink verification and deduplication checks on a per-file-list basis...

kernel: Fix of 4 CVEs

media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccoreinit CVE-2022-49478 - x86/kvm: Disable kvmclock on all CPUs on shutdown CVE-2021-47110 - cifs: fix potential double free during failed mount CVE-2022-49541 - drm/amd/pm: fix double free in siparsepowertable CVE-2022-49530...

httpd: Fix of 2 CVEs

CVE-2024-47252: escape characters are now properly handled in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to mitigate HTTP desynchronisation attack...

kernel: Fix of 3 CVEs

posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - schqfq: make qfqqlennotify idempotent CVE-2025-38177 - schhfsc: make hfscqlennotify idempotent CVE-2025-38177 - schdrr: make drrqlennotify idempotent CVE-2025-38177 - schhtb: make htbqlennotify...

wget: Fix of CVE-2024-38428

CVE-2024-38428: fix mishandle semicolons in userinfo subcomponent of URI to prevent insecure behavior...

java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08. That fixes following CVEs: - CVE-2025-30749: better Glyph drawing - CVE-2025-30754: enhance TLS protocol support - CVE-2025-30761: improve scripting supports - CVE-2025-50106: glyph out-of-memory access and crash...

Update of tzdata

Fix incorrect tzdb.dat by harding links...

libxml2: Fix of CVE-2025-32415

CVE-2025-32415: fix heap buffer overflow in xmlSchemaIDCFillNodeTables...

libxml2: Fix of CVE-2025-27113

CVE-2025-27113: fix compilation of explicit child axis...

libssh2: Fix of CVE-2026-66032

CVE-2026-66032: nullify data after free in sftpopen to prevent a double-free when sftppacketrequire fails on the FXPSTATUS/FXOK path...

cups: Fix of CVE-2025-58060

CVE-2025-58060: fix authentication bypass in the scheduler by blocking authentication attempts using a method other than the configured AuthType...

vim: Fix of CVE-2026-59858

CVE-2026-59858: fix arbitrary Ex command execution in C omni-completion by escaping the typeref/typename tag field before inserting it into the :vimgrep pattern in ccomplete.vim upstream 9.2.0735...

vim: Fix of CVE-2026-57456

CVE-2026-57456: use repr to quote python omni-completion doc strings before exec in the Scope/Class/Function getcode of pythoncomplete/python3complete, preventing code execution via a crafted docstring upstream 9.2.0699...

file: Fix of CVE-2019-18218

CVE-2019-18218: fix heap-based buffer overflow in cdfreadpropertyinfo...

subversion: Fix of CVE-2017-9800

CVE-2017-9800: fix arbitrary code execution via crafted svn+ssh:// URLs by validating the decoded hostinfo and adding an end-of-options guard to the default svn+ssh and example rsh tunnel commands...

nss: Fix of CVE-2020-25648

CVE-2020-25648: fix DoS in case of receiving multiple CCS messages - extended tests...

libxml2: Fix of CVE-2025-6021

CVE-2025-6021: fix integer overflows in buffer size calculations...

squid: Fix of CVE-2025-54574

CVE-2025-54574: fix buffer overflow in URN handling...

dmidecode: Fix of CVE-2023-30630

CVE-2023-30630: prevent --dump-bin from overwriting local files to address privilege escalation vulnerability...

sssd: Fix of CVE-2023-3758

CVE-2023-3758: fix race condition in adgpo...

expat: Fix of CVE-2026-56407

CVE-2026-56407: signed integer overflow in doProlog when an internal entity value longer than INTMAX XMLChars truncates ENTITY.textLen to a negative length...

libssh2: Fix of 2 CVEs

CVE-2019-3858: fix zero-byte allocation in sftppacketread - CVE-2019-3859: fix out-of-bounds reads in libssh2packetrequire...