dovecot: Fix of CVE-2020-12674

CVE-2020-12674: fix mishandling of zero length in RPA request to prevent auth service crash...

libwebp: Fix of CVE-2020-36328

CVE-2020-36328: fix a heap-based buffer overflow in WebPDecodeInto functions...

glibc: Fix of CVE-2019-9169

CVE-2019-9169: fix heap-based buffer over-read in proceednextnode in posix/regexec.c...

squid34: Fix of CVE-2025-54574

CVE-2025-54574: fix buffer overflow in URN handling...

java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08. That fixes following CVEs: - CVE-2025-30749: better Glyph drawing - CVE-2025-30754: enhance TLS protocol support - CVE-2025-30761: improve scripting supports - CVE-2025-50106: glyph out-of-memory access and crash...

perl: Fix of CVE-2018-18311

CVE-2018-18311: fix buffer overflow...

rsync: Fix of CVE-2024-12087

CVE-2024-12087: fix path traversal vulnerability by adding a proper symlink verification and deduplication checks on a per-file-list basis...

rsync: Fix of CVE-2024-12088

CVE-2024-12088: fix improper verification of symbolic link destinations to prevent path traversal vulnerability...

kernel: Fix of 4 CVEs

media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccoreinit CVE-2022-49478 - x86/kvm: Disable kvmclock on all CPUs on shutdown CVE-2021-47110 - cifs: fix potential double free during failed mount CVE-2022-49541 - drm/amd/pm: fix double free in siparsepowertable CVE-2022-49530...

openssh: Fix of CVE-2026-60000

CVE-2026-60000: fix GSSAPI pre-authentication denial of service where inputgssapierrtok did not finish the postponed authentication attempt, so failed GSSAPI requests were never counted against MaxAuthTries...

libssh2: Fix of CVE-2026-58050

CVE-2026-58050: cap publickey list attribute count to prevent 32-bit multiplication overflow in libssh2publickeylistfetch...

perl: Fix of 2 CVEs

CVE-2026-13221: regex trie construction in Sstudychunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches GH23388 — decline the trie optimization when the span would overflow -...

glib2: Fix of 2 CVEs

CVE-2026-58011: out-of-bounds read from an invalid GDateTime produced by gdatetimeaddfull without range validation, later read by gdatetimegetymd - CVE-2026-58013: heap buffer over-read in giochannelreadlinebackend when a multi-byte line terminator is memcmp'd past the end of the buffer...

libxml2: Fix of CVE-2026-11979

CVE-2026-11979: add bounds checks in xmlcatalog --shell usershell to prevent stack buffer overflows when parsing overly long command lines...

httpd: Fix of 2 CVEs

CVE-2026-29170: modproxyftp: XSS in generated HTML directory listing; escape entry names with apescapehtmlaposescapepath instead of apescapeuri in href attributes - CVE-2026-42535: moddavfs: deny WebDAV access to or within the DAVFSSTATEDIR state directory to prevent manipulation of trusted...

httpd: Fix of CVE-2025-58098

CVE-2025-58098: modcgid with SSI exec cmd passed the shell-escaped query string as extra arguments to the executed shell command; do not pass r-args for SSI requests...

openssl: Fix of CVE-2026-45447

CVE-2026-45447: fix possible use-after-free in PKCS7verify with empty digestAlgorithms SET...

bind: Fix of CVE-2025-40778

CVE-2025-40778: Tighten restrictions on caching NS RRsets in the authority section require the NS owner name to be an ancestor of the queried name to prevent cache poisoning via spoofed records...

libssh2: Fix of 2 CVEs

CVE-2019-3858: fix zero-byte allocation in sftppacketread - CVE-2019-3859: fix out-of-bounds reads in libssh2packetrequire...

libxml2: Fix of CVE-2022-49043

CVE-2022-49043: fix use-after-free in xmlXIncludeAddNode, free URI after reporting the error to avoid use-after-free...

cups: Fix of CVE-2023-4504

CVE-2023-4504: check for null terminator after a backslash...

spamassassin: Fix of 2 CVEs

CVE-2020-1930: fix command-execution vulnerability in SpamAssassin .cf parsing - CVE-2020-1931: fix command-execution vulnerability in SpamAssassin .cf parsing...

glibc: Fix of CVE-2020-1752

CVE-2020-1752: fix use-after-free vulnerability in glob...

dovecot: Fix of CVE-2020-12673

CVE-2020-12673: fix reading past buffer...

httpd: Fix of 2 CVEs

CVE-2024-47252: escape characters are now properly handled in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to mitigate HTTP desynchronisation attack...

kernel: Fix of 3 CVEs

posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - schqfq: make qfqqlennotify idempotent CVE-2025-38177 - schhfsc: make hfscqlennotify idempotent CVE-2025-38177 - schdrr: make drrqlennotify idempotent CVE-2025-38177 - schhtb: make htbqlennotify...

wget: Fix of CVE-2024-38428

CVE-2024-38428: fix mishandle semicolons in userinfo subcomponent of URI to prevent insecure behavior...

sqlite: Fix of CVE-2025-6965

CVE-2025-6965: fix a potential memory corruption if the number of aggregate terms in a query exceeds the maximum number of columns...

Update of tzdata

Fix incorrect tzdb.dat by harding links...

libxml2: Fix of CVE-2025-27113

CVE-2025-27113: fix compilation of explicit child axis...

vim: Fix of CVE-2026-59858

CVE-2026-59858: fix arbitrary Ex command execution in C omni-completion by escaping the typeref/typename tag field before inserting it into the :vimgrep pattern in ccomplete.vim upstream 9.2.0735...

nginx: Fix of CVE-2026-49975

CVE-2026-49975: add maxheaders directive default 1000 to cap HTTP/2 request-header memory exhaustion HTTP/2 Bomb...

vim: Fix of CVE-2026-52860

CVE-2026-52860: fix possible code execution in python3complete/pythoncomplete by stripping default expressions and annotations from function parameter lists and whitelisting class bases to dotted names before exec upstream patch 9.2.0597...

openvpn: Fix of CVE-2020-15078

CVE-2020-15078: fix authentication bypass and access to control channel data on servers configured with deferred authentication...

libxml2: Fix of CVE-2025-6021

CVE-2025-6021: fix integer overflows in buffer size calculations...

squid: Fix of CVE-2025-54574

CVE-2025-54574: fix buffer overflow in URN handling...

dmidecode: Fix of CVE-2023-30630

CVE-2023-30630: prevent --dump-bin from overwriting local files to address privilege escalation vulnerability...

subversion: Fix of CVE-2024-46901

CVE-2024-46901: fix moddavsvn denial-of-service via control characters in paths...

sssd: Fix of CVE-2023-3758

CVE-2023-3758: fix race condition in adgpo...

libxml2: Fix of CVE-2025-32415

CVE-2025-32415: fix heap buffer overflow in xmlSchemaIDCFillNodeTables...

vim: Fix of CVE-2026-57456

CVE-2026-57456: use repr to quote python omni-completion doc strings before exec in the Scope/Class/Function getcode of pythoncomplete/python3complete, preventing code execution via a crafted docstring upstream 9.2.0699...

squid34: Fix of CVE-2025-62168

CVE-2025-62168: Redact HTTP authentication credentials in error handling to prevent information disclosure...

nss: Fix of CVE-2020-25648

CVE-2020-25648: fix DoS in case of receiving multiple CCS messages - extended tests...

curl: Fix of 2 CVEs

CVE-2026-8927: fix cross-proxy Digest auth state leak with env-set proxies - CVE-2026-8932: fix incomplete mTLS config matching in connection reuse...

cups: Fix of CVE-2025-58060

CVE-2025-58060: fix authentication bypass in the scheduler by blocking authentication attempts using a method other than the configured AuthType...

squid34: Fix of 2 CVEs

CVE-2026-47729: fix out-of-bounds read in FTP directory listing parsing when a TypeA/TypeB date is not followed by a filename - CVE-2026-50012: harden peerDigestSwapInMask against a cache digest reply whose on-the-wire size exceeds the declared masksize heap buffer overflow...

libssh2: Fix of CVE-2026-66032

CVE-2026-66032: nullify data after free in sftpopen to prevent a double-free when sftppacketrequire fails on the FXPSTATUS/FXOK path...

tomcat6: Fix of CVE-2026-55957

CVE-2026-55957: tomcat6: JNDIRealm GSSAPI authenticated bind allowed authentication without the correct password...

curl: Fix of CVE-2026-8286

CVE-2026-8286: fix connection reuse for STARTTLS with mismatching TLS config...

expat: Fix of CVE-2026-56131

CVE-2026-56131: fix use-after-free caused by XMLResumeParser being callable from inside a handler, which re-enters the parser while the outer frame still owns bufferPtr/eventPtr...