Updated xdg-dbus-proxy packages fix security vulnerabilities

filtering for broadcast messages bypassing path/interface/member checks...

Updated pipewire packages fix security vulnerabilities

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return. CVE-2026-14324 Multiple unbounded alloca calls in the PulseAudio protocol server. CVE-2026-14330...

Updated libwebsockets packages fix a security vulnerability

warmcat libwebsockets SSH Protocol sshd.c lwssshparseplaintext resource consumption. CVE-2026-10650...

Updated coreutils package fixes a security vulnerability

Out‑of‑bounds Read in GNU coreutils. CVE-2026-56391...

Updated nss & firefox packages fix security vulnerabilities

Use-after-free in the Audio/Video: Web Codecs component. CVE-2026-92005 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. CVE-2026-92006 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. CVE-2026-92007...

Updated libnfs package fixes a security vulnerability

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READIOVEC in rpcreadfromsocket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker. CVE-2026-57918...

Updated borgbackup package fixes a security vulnerability

The updated package fixes a security vulnerability: CVE-2026-62268...

Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

Updated rest packages fix a security vulnerability

Weak random number generation in pkce implementation. CVE-2026-16615...

Updated diffutils packages fix a security vulnerability

Heap-based Buffer Overflow in GNU diffutils. CVE-2026-53910...

Updated perl-Dancer2 packages fix a security vulnerability

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. CVE-2026-13577...

Updated pcre2 packages fix a security vulnerability

Out-of-bounds write in pcre2dfamatch with recursive patterns under a low heap limit CVE-2026-86145...

Updated nmap packages fix a security vulnerability

Denial of Service via Zero-Length TCP Option Packet. CVE-2026-72712...

Updated vim packages fix security vulnerabilities

Out-of-bounds Access in libvterm Resize Handling in Vim = v8.1.0688...

Updated libde265 package fixes security vulnerabilities

Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc. CVE-2024-38949 Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to...

Updated python-configargparse packages fix security vulnerabilities

Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values...

Updated ntpsec packages fix a security vulnerability

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' in ntpsec. CVE-2026-18321...

Updated libssh packages fix security vulnerabilities

Stack buffer overflow in SFTP server longname construction. CVE-2026-15370 Denial of service via zero advertised channel packet size. CVE-2026-59843 Denial of service via oversized SFTP read length. CVE-2026-59844 Denial of service via unchecked ProxyCommand fork failure. CVE-2026-59845 Informati...

Updated perl-YAML packages fix a security vulnerability

Updated packages fixes CVE-2026-63676...

Updated mpg123 package fixes security vulnerabilities

Updated packages fix security vulnerabilities, please se the reference...

Updated python-httplib2 packages fix a security vulnerability

Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. CVE-2026-59939...

Updated patch package fixes security vulnerabilities

NULL Pointer Dereference in GNU patch. CVE-2026-56288 Loop with Unreachable Exit Condition in GNU patch. CVE-2026-56289...

Updated ntfs-3g packages fix security vulnerabilities

Heap memory corruption when processing a corrupt or maliciously crafted filesystem. CVE-2026-42616 Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. CVE-2026-42617 Single-byte heap buffer overflow when decompressing...

Updated bind package fixes security vulnerabilities

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification CVE-2026-19033. qpcache NOQNAME proof use-after-free crashes recursive resolver CVE-2026-19662. Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path CVE-2026-19666. Remote assertion failure via 16-bit...

Updated postfix packages fix security vulnerabilities

Updated packages fix security issues. Please see the references...

Updated gawk packages fix security vulnerabilities

Use after free in gawk. CVE-2026-40467 Heap buffer overflow in gawk. CVE-2026-40468 Heap buffer overflow in gawk. CVE-2026-40469 Stack-based buffer overflow in gawk. CVE-2026-40553...

Updated gstreamer1.0-plugins-base packages fix a security vulnerability

GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. CVE-2026-18297...

Updated gdk-pixbuf2.0 packages fix security vulnerabilities

Heap‑buffer‑overflow in gdk‑pixbuf. CVE-2025-7345 Out-of-bounds read in ico parser. CVE-2026-16768 Invalid write in jpeg icc profile parser on error recovery. CVE-2026-81893...

Updated graphicsmagick packages fix a security vulnerability

Integer overflows in MNG magnification. CVE-2025-55154...

Updated libpcap packages fix security vulnerabilities

OOBR and OOBW in libpcap before 1.10.7. CVE-2026-0799 abort in libpcap before 1.10.7 on an invalid BPF opcode. CVE-2026-31911 OOBR in libpcap before 1.10.7. CVE-2026-31912 Division by zero in libpcap before 1.10.7. CVE-2026-6244 Infinte loop in libpcap before 1.10.7. CVE-2026-6554 rpcapd memory...

Updated imagemagick package fixes security vulnerabilities

Heap-use-after-free in Layer method of PerlMagick could result in a crash Path Policy TOCTOU symlink race bypass in the video decoder Heap-use-after-free in the GetList method of PerlMagick could result in a crash Memory Leak in MSL decoder Denial of service when exhausting the process memory...

Updated python-starlette package fixes security vulnerabilities

Arbitrary HTTP method dispatched to HTTPEndpoint attributes via getattr. CVE-2026-48817 Unvalidated request path concatenated into authority poisons request.url.hostname. CVE-2026-54282...

Updated cockpit packages fix a security vulnerability

Cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in sendloginhtml. CVE-2026-76235...

Updated packagekit packages fix a security vulnerability

PackageKit API pk-transaction.c gfiletest improper authorization. CVE-2026-10294...

Updated aom packages fix security vulnerabilities

Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. CVE-2026-56208 Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. CVE-2026-56209 Heap-buffer-overflow read via missing bounds check in ctrlsetlayerid. CVE-2026-56210 Remote code executi...

Updated libgd packages fix a security vulnerability

A vulnerability was discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed GIF file is processed...

Updated python-h2 packages fix a security vulnerability

Duplicate Host header facilitate request smuggling. CVE-2026-71554...

Updated perl-Authen-SASL packages fix a security vulnerability

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. CVE-2026-86219...

Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...

Updated libssh2 packages fix security vulnerabilities

Double-Free Heap Corruption via sftpopen. CVE-2026-66032 Integer Underflow DoS via AES-GCM Cipher Negotiation. CVE-2026-66033 Heap Buffer Overflow via ETM Cipher Negotiation. CVE-2026-66035...

Updated perl-HTML-FormFu packages fix a security vulnerability

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. CVE-2026-19873...

Updated libcupsfilters & cups-filters packages fix security vulnerabilities

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel. CVE-2026-64611 cups image filter process abort via malformed png. CVE-2026-64612...

Updated bzip2 packages fix a security vulnerability

Off-by-One Leading to Out-of-Bounds Write in bzip2. CVE-2026-42250...

Updated unzip packages fix security vulnerabilities

Vulnerabilities were discovered in the Info-ZIP unzip program, which could result in the execution of arbitrary code if a specially crafted file is processed...

Updated zip packages fix a security vulnerability

zip test option -T command injection. Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash or possibly have unspecified other impact because of an off-by-one error. CVE-2018-13410...

Updated bind package fixes a security vulnerability

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service CVE-2026-13204...

Updated ffmpeg package fixes security vulnerabilities

Out-of-Bounds Write in RASC Decoder decodedlta. CVE-2026-58049 Heap Buffer Overflow via VobSub Subtitle Demuxer. CVE-2026-64830 Double-Free in NVDEC Hardware Decoder via nvdec.c. CVE-2026-64832 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c. CVE-2026-64833 Infinite Loop DoS via RTP/ASF Demuxer...

Updated xz packages fix security vulnerabilities

XZ Utils: Invalid write if a decoder is reinitialized after allocation failure...

Updated librabbitmq packages fix security vulnerabilities

amqpdecodebytes sizet integer overflow bypasses bounds check on 32-bit OOB read. CVE-2026-59986 Heap Buffer Overflow in amqpsendframe When Serializing Oversized AMQPFRAMEBODY. CVE-2026-61547...

Updated java-21-openjdk & java-17-openjdk packages fix security vulnerabilities

Enhance TLS certificate handling. CVE-2026-46968 Improve DTLS handshaking. CVE-2026-46917 Enhance JPEG handling. CVE-2026-47010 Enhance XBM image support. CVE-2026-47021 Enhance Jar file processing. CVE-2026-47027 Improve certification checking. CVE-2026-60147 Enhance AWT ImagingLib. CVE-2026-470...