kernel: Fix of 5 CVEs

net/sched: schhfsc: upgrade 'rt' to 'sc' when it becomes a inner curve CVE-2023-4623 - net/sched: Enforce that teql can only be used as root qdisc CVE-2026-23074 - ALSA: usb-audio: Fix use-after-free in sndusbmixerfree CVE-2026-23089 - atm: atmtcp: Prevent arbitrary write in atmtcprecvcontrol...

squid: Fix of CVE-2023-46728

CVE-2023-46728: Remove support for Gopher protocol - Enable test-suite...

squid34: Fix of CVE-2023-46847

CVE-2023-46847: Fix stack buffer overflow when parsing Digest Authorization...

exim: Fix of CVE-2022-3559

CVE-2022-3559: Fix $regex use-after-free...

amanda: Fix of 2 CVEs

CVE-2022-37705: fix tar option filtering - CVE-2023-30577: introduce tar option allow list...

vim: Fix of CVE-2023-2610

CVE-2023-2610: limit the text length to MAXCOL...

perl: Fix of CVE-2020-16156

CVE-2020-16156: recognize CANNOTVERIFY signature verification type...

Fixed CVE-2021-33582 in cyrus-imapd

CVE-2021-33582: Fix a bad string hashing algorithm which could lead to collisions and cause a CPU denial of service...

Update of squid34

...

bind: Fix of CVE-2026-1519

CVE-2026-1519: Limit NSEC3 iterations when validating referrals to unsigned delegations to avoid excessive CPU consumption...

curl: Fix of CVE-2026-3784

CVE-2026-3784: fix proxy connection reuse with different credentials - update outdated timestamps in test 046...

kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...

php: Fix of CVE-2024-11233

CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode filter...

Update of php 5.3: Remove mariadb102 patch to eliminate faulty functionality

Remove mariadb102 patch to eliminate faulty functionality...

kernel: Fix of 14 CVEs

nfnetlinkosf: validate individual option lengths in fingerprints CVE-2026-23397 - netfilter: nfnetlinkosf: avoid OOB read CVE-2026-23397 - bonding: limit BONDMODE8023AD to Ethernet devices CVE-2026-23099 - netlabel: fix out-of-bounds memory accesses CVE-2019-25160 - ext4: always check block group...

kernel: Fix of 3 CVEs

NFSv4.0: Fix a use-after-free problem in the asynchronous open CVE-2024-53173 - ALSA: usb-audio: Fix out of bounds reads when finding clock sources CVE-2024-53150 - misc/libmasm/module: Fix two use after free in ibmasminitone CVE-2021-47334...

Fix of CVE: CVE-2021-27135

CVE-2021-27135: fix crash when processing combining characters...

Update of php 5.3: Fix segfault during graceful Apache restart

ELS-42: Fix segfault during graceful Apache restart...

libssh2: Fix of CVE-2026-58050

CVE-2026-58050: cap publickey list attribute count to prevent 32-bit multiplication overflow in libssh2publickeylistfetch...

kernel: Fix of 8 CVEs

rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 - xfs: fix freemap adjustments when adding xattrs to leaf blocks CVE-2026-43158 - xfs: delete attr leaf freemap entries when empty CVE-2026-43158 - ALSA: 6fire: fix use-after-free on disconnect CVE-2026-31581 - brcmfmac:...

php: Fix of CVE-2024-8925

CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

Update of ca-certificates

update to CKBI 2.64 from NSS 3.95 - updated: - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed old certificates: - Certificate "E-Tugra Certification Authority" - Certificate "Hongkong Post Root CA 1" - Certificate "Symantec Class 1 Public Primary Certification...

squid34: Fix of CVE-2023-46728

CVE-2023-46728: Remove support for Gopher protocol...

Update of openssl-static, openssl-perl, openssl-devel, openssl, openssl-devel, openssl

Always check certificates from local root store first...

kernel: Fix of 43 CVEs

Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...

zlib: Fix of CVE-2016-9843

CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation...

python: Fix of 2 CVEs

CVE-2024-7592: fix algorithm with quadratic complexity to avoid using excess CPU resources while parsing the cookie value - CVE-2024-6232: fix regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing and was vulnerable to ReDoS via specifically-crafted tar...

java-1.8.0-openjdk: Fix of 6 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u422-b05. That fixes following CVEs: - CVE-2024-21131: UTF8 size overflow - CVE-2024-21138: Infinite loop vunlerability in SymbolTable - CVE-2024-21140: Int overflow/underflow in Range Check Elimination RCE - CVE-2024-21144: Invalid header...

vim: Fix of CVE-2023-4733

CVE-2023-4733: verify oldwin pointer after resetVIsual...

samba: Fix of CVE-2017-15275

CVE-2017-15275: Fix server heap memory information leak by zeroing unused area when messagepushstring grows the talloc buffer...

java-1.8.0-openjdk: Fix of 5 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u482-b08. That fixes following CVEs: - CVE-2025-53057: Security: enforce proper access control in certificate handling to prevent data tampering - CVE-2025-53066: JAXP: restrict data access in Path Factory processing to prevent information...

git: Fix of CVE-2024-32004

CVE-2024-32004: integrating ownership checking to detect dubious local repositories during cloning...

Update of ca-certificates

update to CKBI 2.58 from NSS 3.67 - removed old certificates: - Certificate "Camerfirma Global Chambersign Root" - Certificate "Cybertrust Global Root" - Certificate "Equifax Secure eBusiness CA 1" - Certificate "Equifax Secure Global eBusiness CA" - Certificate "Explicitly Distrusted DigiNotar...

curl: Fix of 2 CVEs

CVE-2026-8927: fix cross-proxy Digest auth state leak with env-set proxies - CVE-2026-8932: fix incomplete mTLS config matching in connection reuse...

php: Fix of 2 CVEs

CVE-2026-6722: Use-after-free in SOAP ext via stale refmap pointer - CVE-2026-7261: Use-after-free in SOAP after header parse failure with SOAPPERSISTENCESESSION...

exim: Fix of CVE-2026-40687

CVE-2026-40687: fix uninitialized buffer and out-of-bounds writes in SPA authenticator...

curl: Fix of 2 CVEs

CVE-2019-5436: tftp: use the current blksize for recvfrom - CVE-2016-8615: cookie: replace use of fgets with custom version...

ansible: Fix of CVE-2019-14904

CVE-2019-14904: validate solariszone name to prevent command injection...

kernel: Fix of 12 CVEs

ext4: fix OOB read when checking dotdot dir CVE-2025-37785 - iscsiibft: Fix UBSAN shift-out-of-bounds warning in ibftattrshownic CVE-2025-21993 - media: uvcvideo: Fix double free in error path CVE-2024-57980 - jffs2: Prevent rtime decompress memory corruption CVE-2024-57850 - wifi: iwlegacy:...

Update of bind-sdb, bind-libs, bind-devel, bind, bind-utils, bind-chroot

...

postfix: Fix of CVE-2026-43964

makedefs: support Linux kernel = 3 on build hosts - CVE-2026-43964: fix buffer over-read on enhanced status code without trailing text...

nginx: Fix of CVE-2026-9256

CVE-2026-9256: fix heap buffer overflow with overlapping captures in ngxhttprewritemodule...

exim: Fix of CVE-2026-40685

CVE-2026-40685: fix OOB heap write in dewrap during JSON expansion...

quagga: Fix of CVE-2018-5381

CVE-2018-5381: bgpd capability parser can enter an infinite loop on invalid OPEN messages whose Multi-Protocol capability has an unrecognized AFI/SAFI, causing a denial of service...

cups: Fix of CVE-2026-34980

CVE-2026-34980: filter control characters from option values in the scheduler to prevent PPD keyword injection via Print-Job...

Update of tzdata

Upgrade to tzdata-2025b - New zone for Aysén Region in Chile which moves from -04/-03 to -03. - Paraguay adopted permanent -03 starting spring 2024. - Improve pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Improve historical data for Mexico, Mongolia, and Portugal. - System V...

php: Fix of CVE-2024-8927

CVE-2024-8927: Fix bypass of cgi.forceredirect configuration...

bind: Fix of CVE-2024-1975

CVE-2024-1975: Remove support for SIG0 message verification - Fix tsiggss test...

Update of openssl-static, openssl, openssl-devel, openssl-perl, openssl, openssl-devel

...

squid: Fix of 2 CVEs

CVE-2026-47729: fix out-of-bounds read in the FTP directory listing parser ftpListParseParts by stopping the whitespace skip at the end of the input buffer - CVE-2026-50012: fix heap buffer overflow in peerDigestSwapInMask by rejecting cache digest replies whose mask data exceeds the declared...