Updated perl-Imager package fixes security vulnerabilities

The updated package fixes security vulnerabilities: The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim method is called on a crafted input image. CVE-2024-53901 Imager versions before 1.032 fo...

Updated perl-CSS-Minifier-XS package fixes a security vulnerability

The updated package fixes a security vulnerability: CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. CVE-2026-13593...

Updated perl-String-Util package fixes a security vulnerability

The updated package fixes a security vulnerability: String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. CVE-2026-14895...

Updated clamav packages fix security vulnerabilities

The updated packages fix security vulnerabilities: PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability. CVE-2026-20213 FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability. CVE-2026-20214 7Zip File Format Processing Out-of-Bounds Memory Corruption...

Updated nmap packages fix a security vulnerability

The updated packages fix a security vulnerability: Integer Underflow in IPv6 Extension Header Parsing. CVE-2026-58058...

Updated perl-Mojolicious package fixes a security vulnerability

The updated package fixes a security vulnerability: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. CVE-2026-14803...

Updated erlang packages fix a security vulnerability

The updated packages fix a security vulnerability: SFTP READLINK response leaks absolute backend filesystem path when root is configured. CVE-2026-48855...

Updated perl-Bytes-Random-Secure package fixes a security vulnerability

The updated package fixes a security vulnerability: Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. CVE-2026-11625...

Updated rsync package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Rsync 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write. CVE-2026-29518 Rsync 3.4.3 Authorization Bypass via Hostname Resolution. CVE-2026-43617 Rsync 3.4.3 Integer Overflow Information Disclosure. CVE-2026-43618 Rsync 3.4.3...

Updated perl-HTML-Parser packages fix security vulnerability

HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. CVE-2026-8829...

Updated perl-Config-IniFiles package fixes a security vulnerability

The updated package fixes a security vulnerability: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle. CVE-2026-11527...

Updated libidn packages fix security vulnerability

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idnatounicodeinternal. The affected code is not present in libidn2. CVE-2026-57053...

Updated upower packages fix security vulnerabilities

The updated packages fix some security issues...

Updated bind packages fix a security vulnerability

The updated bind packages fix a security vulnerability: When BIND 9 was configured to use DNS64 and encounters a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data...

Updated python-pydantic-settings packages fix a security vulnerability

The updated packages fix a security vulnerability: NestedSecretsSettingsSource follows symlinks outside secretsdir, enabling local file read and bypassing secretsdirmaxsize. CVE-2026-58203...

Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Updated libreoffice packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap buffer overflow in DXF polyline import. CVE-2026-6039 Heap use-after-free in ODF number-format blank-width parsing. CVE-2026-6040 Heap buffer overflow in EMF+ gradient brush import. CVE-2026-6045 Stack buffer overflow in PPT presentation...

Updated poppler packages fix a security vulnerability

The updated packages fix a security vulnerability: Integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication. CVE-2026-10118...

Updated openssl packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion. CVE-2026-7383 Out-of-Bounds Read in CMS Password-Based Decryption. CVE-2026-9076 Heap Buffer Over-read in ASN.1 Content Parsing. CVE-2026-34180 PKCS12 Files with PBMAC1 Are...

Updated tmux packages fix a security vulnerability

The updated package fixes a security vulnerability: tmux image.c imagefree use after free. CVE-2026-11623...

Updated python-mistune package fixes security vulnerabilities

The updated python-mistune package fixes two security vulnerablities: Prior to 3.2.1, rendertocul builds a table-of-contents tree from a list of level, id, text tuples. Both the id value used as href="" and the text value used as the visible link label are inserted into tags via a plain Python...

Updated imagemagick packages fix security vulnerabilities

The updated packages fix numerous security vulnerabilities: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797. CVE-2026-25797 Heap Buffer Underwrite in Floyd-Steinberg depth dithering. CVE-2026-48724 Infinite Loop in subimage-search with crafted image. CVE-2026-48733 Stack...

Updated haproxy packages fix security vulnerability

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record...

Updated perl-Socket packages fix security vulnerability

Socket versions before 2.041 for Perl have an out-of-bounds heap read. CVE-2026-12087...

Updated libxml2 packages fix a security vulnerability

The updated packages fix a security vulnerability: Denial of service via crafted xsd-validated document. CVE-2026-6732...

Updated ffmpeg packages fix a security vulnerability

The updated packages fix a security vulnerability: Heap out-of-bounds write via odd sliceheight in FFmpeg MagicYUV decoder. CVE-2026-8461...

Updated gzip package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Predictable Temporary File in GNU gzip. CVE-2026-41991 Global Buffer Overflow in GNU gzip. CVE-2026-41992...

Updated firefox, firefox-l10n, rootcerts, nss packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Privilege escalation in the Graphics: WebRender component. CVE-2026-12289 Memory safety bug fixed in Firefox ESR 140.12. CVE-2026-12290 Use-after-free in the Networking: HTTP component. CVE-2026-12291 Incorrect boundary conditions in the Web Audi...

Updated thunderbird thunderbird-l10n packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Privilege escalation in the Graphics: WebRender component. CVE-2026-12289 Memory safety bug fixed in Thunderbird ESR 140.12. CVE-2026-12290 Use-after-free in the Networking: HTTP component. CVE-2026-12291 Incorrect boundary conditions in the Web...

Updated perl-List-SomeUtils-XS packages fix security vulnerability

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. CVE-2026-12844...

Updated libtiff packages fix a security vulnerability

The updated packages fix a security vulnerability: Denial of Service via large SamplesPerPixel tag. CVE-2026-36849...

Updated libheif packages fix security vulnerabilities

libheif has a Heap OOB Read/SEGV Crash via Zero samplesperchunk. CVE-2026-32738 libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup. CVE-2026-32739 Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing. CVE-2026-32740 libheif has a heap buffer overflow in...

Updated libarchive packages fix security vulnerabilities

The updated packages fix bugs including security ones...

Updated vim packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Arbitrary Code Execution via Python Omni-Completion in Vim 9.1.1783 && Vim = 9.2.0320 && Vim 9.2.0679. CVE-2026-57454 Out-of-bounds Write in SOFO Soundfolding in Vim 9.2.0698. CVE-2026-57455 Arbitrary Code Execution via Python Omni-Completion...

Updated 7zip packages fix a security vulnerability

7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation. CVE-2026-48095...

Updated ack packages fix security vulnerabilities

This update fixes several security vulnerabilities...

Updated vips packages fix security vulnerabilities

This update fixes several security issues: A flaw has been found in libvips up to 8.18.0. The affected element is the function vipsforeignloadmatrixfileisa/vipsforeignloadmatrixheader of the file libvips/foreign/matrixload.c. Executing a manipulation can lead to memory corruption. The attack need...

Updated openvpn packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible 1-byte buffer overrun on NTLMv2 proxy responses. CVE-2026-11771 Memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes. CVE-2026-12932 Use-after-free bug in ackwritebuf,...

Updated mariadb packages fix security vulnerabilities

This update to the latest LTS version fixes some severe security vulnerabilities...

Updated yt-dlp packages fix security vulnerabilities

CVE-2026-50019 If curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. CVE-2026-50023 A vulnerability exists in yt-dlp that allows a remote attacker to write...

Updated krb5 packages fix security vulnerabilities

CVE-2025-3576, A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity...

Updated nats-server packages fix security vulnerabilities

nats-server and its dependencies are updated to fix CVE-2025-30215 Missing access controls for JS API in multi-tenancy...

Updated podofo packages fix security vulnerabilities

Podofo v0.9.8 shares some of the vulnerable code that was discovered in Podofo v0.10.0. This package fixes that. CVE-2023-31567 Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3. CVE-2023-31568 Podofo v0.10.0 was discovered ...

Updated opensc packages fix security vulnerabilities

These packages fix security vulnerabilities: CVE-2026-10275, A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is...

Updated perl-Archive-Tar package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. CVE-2026-42496 Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the...

Updated sslh packages fix security vulnerabilities

CVE-2025-46806, A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures CVE-2025-46807, A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny...

Updated mumble packages fix security vulnerability

Mumble is prone to an out-of-bounds array access, which may result in denial of service client crash...

Updated opensc packages fix security vulnerabilities

CVE-2025-66038 Memory corruption via improper compact-TLV length validation CVE-2025-66215 Stack-buffer-overflow with physical access via crafted smart card or USB device CVE-2025-49010 Stack-buffer-overflow via crafted smart card or USB device responses CVE-2025-66037 Out-of-bounds read via...

Updated ruby-rack packages fix security vulnerabilities

CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. Forwarded header semicolon injection enables Host and Scheme spoofing. CVE-2026-34230 Quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header. CVE-2026-34763 Root...

Updated luajit packages fix security vulnerabilities

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and options are mishandled. CVE-2019-19391 LuaJIT through 2.1.0-beta3 h...