Updated tor packages fix security vulnerabilities

Tor before 0.4.9.12 interprets the CCRESPONSE extension even when CCREQUEST was not sent, which allows remote attackers to cause a denial of service crash because of corrupted congestion-control stateCVE-2026-87724 Do not purge memory for OOM from within low-level code TROVE-2026-043. A hostile...

Updated glibc package fixes security vulnerabilities

Potential buffer overflow in nssprintrrf TSIG handling path. CVE-2026-5435 Buffer overread in nsprintrrf with corrupted RDATA field. CVE-2026-6238 wordexp with WRDEAPPEND can return or use invalid memory. CVE-2026-6368 Potential stack-based buffer clash during tilde expansion in wordexp...

Updated perl-DBI packages fix security vulnerabilities

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in...

Updated ceph packages fix security vulnerabilities

Updated ceph packages fix various security issues allowing authentication bypasses to gain admin privileges on the OSD, MDS, and MGR services. Notice that some of the fixes require kernel support for aes256k introduced in kernel 7. This update will not break installs using the old and insecure AE...

Updated firefox & nss packages fix security vulnerabilities

Sandbox escape in the Remote Settings Client component. CVE-2026-75874 Privilege escalation in the DOM: Workers component. CVE-2026-16365 Use-after-free in the JavaScript: GC component. CVE-2026-84118 Sandbox escape due to use-after-free in the DOM: Navigation component. CVE-2026-84119...

Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. CVE-2026-84639 One byte overflow read in mail parser. CVE-2026-84640 Information disclosure due to malicious IMAP server response. CVE-2026-84641 Calendar invitation attachments could launch local executables. CVE-2026-84637 Allowed UNC hostnames for...

Updated wget packages fix a security vulnerability

Denial of Service in GNU wget. CVE-2026-16599...

Updated spice-vdagent packages fix security vulnerabilities

Integer overflow in udscswrite leading to heap buffer overflow. CVE-2026-57965 Path traversal in file transfer via unsanitized filename. CVE-2026-57966...

Updated dovecot package fixes security vulnerabilities

submission-login: Panic when mailmaxuseripconnections is reached: Panic: epollctldel, 8 failed: Bad file descriptor. CVE-2026-33263 Dovecot IMAP LIST matchsub Exponential Backtracking — CPU Denial of Service. CVE-2026-33607 DoS by sending mail with bad header. CVE-2026-27852 dsync: Mail content c...

Updated freerdp packages fix security vulnerabilities

Updated packages bring lot of security fixes. Please see the links for additional information...

Updated tor packages fix security vulnerabilities

An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type CVE-2026-77642. A NULL write after free when sending a CONFLUXSWITCH cell fails, resulting in a crash CVE-2026-77641. An infinite loop when decompressing a truncated zlib/gzip stream with...

Updated exiv2 package fixes security vulnerabilities

Heap out-of-bounds write in RemoteIo when reading from a malicious remote server WebReady/Curl builds. CVE-2026-68546 Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. CVE-2026-68547 Out of bounds read in CrwMap::decodeBasic. CVE-2026-49275...

Updated apache-mod_auth_openidc packages fix a security vulnerability

Out-of-bounds read and write in state cookie parsing. CVE-2026-54789...

Updated python-pyasn1 packages fix security vulnerabilities

The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a 1 ...

Updated python-linkify-it-py package fixes security vulnerabilities

LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. Fix quadratic complexity in LinkifyIt.match, port of linkify-it 5.0.1 and 5.0.2 upstream CVE-2026-48801, CVE-2026-59887 82 Match validators at a position instead of slicing the tail, needed because Pytho...

Updated mingw-expat & expat packages fix security vulnerabilities

Expat Denial of Service via storeAtts Quadratic Complexity. CVE-2026-66046 Expat Out-of-Bounds Read via dtdCopy. CVE-2026-76641 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding...

Updated tomcat packages fix security vulnerabilities

Incorrect URL decoding in RewriteValve may allow security control bypass. CVE-2026-59083 EncryptInterceptor requirements not clearly documented. CVE-2026-59084 DoS via WebSocket chat example. CVE-2026-66299 Bypass longest prefix security constraint. CVE-2026-65182 TOCTOU when setting specific...

Updated mbedtls packages fix security vulnerabilities

TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. CVE-2026-25832 Possible buffer overflow in mbedtlsecdhcalcsecret. CVE-2026-35336 X.509 CA bit forgery via invalid basicConstraints extension. CVE-2026-49300 Use-after-free in mbedtlspkcs7free when reusing a PKCS7 context...

Updated microcode packages fix security vulnerabilities

A potential security vulnerability for some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions Intel® TDX may allow escalation of privilege. CVE-2025-31936 A potential security vulnerability in some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions Intel® TDX may allow...

Updated libopenmpt packages fix security vulnerabilities

Please see the links for information about the vulnerabilities...

Updated python-gitpython packages fix security vulnerabilities

CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439. CVE-2023-41040 In order to resolve some git references, GitPython reads files from the .git directory, in some places t...

Updated apr-util packages fix security vulnerabilities

Apache Portable Runtime Utility: aprpasswordvalidate vulnerable to timing attack. CVE-2025-49506 Apache Portable Runtime Utility: apr-util XML stack recursion crash. CVE-2026-32327 Apache Portable Runtime Utility: SQL Injection in aprdbdoracle. CVE-2026-34191 Apache Portable Runtime Utility: Heap...

Updated perl-Net-OAuth packages fix security vulnerabilities

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire Net::OAuth versions before 0.3...

Updated libarchive packages fix security vulnerabilities

Double-free vulnerability in rar5 decompression logic via dangling filteredbuf pointer in initunpack. CVE-2026-14164 Heap overflow oob read while parsing a tar archive contains a pax extended header. CVE-2026-15028 A null pointer dereference vulnerability exists in the acl parser of libarchive...

Updated perl-XML-Bare packages fix security vulnerabilities

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes...

Updated perl-YAML-Syck packages fix security vulnerabilities

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec YAML::Syck versions before 1.47...

Updated bubblewrap package fixes security vulnerabilities

Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup...

Updated libalsa2 packages fix security vulnerabilities

alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow. CVE-2026-25068 ALSA Library 1.2.16.1 Double-Free via parsedef in conf.c. CVE-2026-56109...

Updated perl-Text-CSV_XS packages fix a security vulnerability

Text::CSVXS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption...

Updated perl-HTML-FormHandler packages fix a security vulnerability

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template...

Updated hplip package fixes security vulnerabilities

Potential Escalation of Privilege and Arbitrary Code Execution. CVE-2026-8631, CVE-2026-8632...

Updated perl-Date-Manip packages fix security vulnerabilities

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime...

Updated perl-HTTP-Date packages fix a security vulnerability

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate...

Updated vim packages fix security vulnerabilities

Arbitrary Code Execution via Shell Keyword Lookup in Vim = 9.2.0469 && Vim = 9.2.0511 && Vim 9.2.0844. CVE-2026-73071 Arbitrary Ex Command Execution in C Omni-Completion in Vim 9.2.0845. CVE-2026-73073 Heap Buffer Overflow when Loading a Spell File in Vim 9.2.0846. CVE-2026-73072 Arbitrary Comman...

Updated varnish packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass. CVE-2026-34475 In Vinyl Cac...

Updated roundcubemail packages fix security vulnerabilities

Add basic validation for content proxied by the css proxy Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading islocalurl check, reported by Milan Hoppe Fix...

Updated perl-Mojolicious packages fix a security vulnerability

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle...

Updated nodejs packages fix security vulnerabilities

http2: retain header memory in session accounting. CVE-2026-56846 http2: defer rst stream while in scope. CVE-2026-56848 permission: avoid granting radix split nodes. CVE-2026-58043 https: distinguish PFX object-array agent keys. CVE-2026-56850 https: bind identity checks to session reuse...

Updated clamav packages fix security vulnerabilities

An indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. CVE-2026-20345 An integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file. CVE-2026-20339 An integ...

Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

Updated openssl packages fix security vulnerabilities

Unbounded Memory Growth in QUIC Server Incoming Channel Queue. CVE-2026-14456 QUIC Server May Trigger Double Free When Processing INITIAL Packet. CVE-2026-18798 Heap Buffer Overflow in CMS Key Unwrapping. CVE-2026-63072 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg...

Updated perl-Plack packages fix a security vulnerability

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting...

Updated perl-Catalyst-Plugin-Authentication packages fix a security vulnerability

Catalyst::Plugin::Authentication versions before 0.10027 for Perl are susceptible to session fixation attacks. CVE-2009-10007...

Updated expat & mingw-expat packages fix security vulnerabilities

Missing control flow integrity checks. CVE-2026-50219 Missing control flow integrity checks. CVE-2026-56131 Out-of-bounds write. CVE-2026-56132 Integer overflow. CVE-2026-56403 Integer overflow. CVE-2026-56404 Integer overflow. CVE-2026-56405 Integer overflow. CVE-2026-56406 Integer overflow...

Updated redis packages fix a security vulnerability

The updated package fixes security vulnerabilities, including: Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write. CVE-2026-62356...

Updated flatpak package fixes security vulnerabilities

Updated flatpak package fixes security vulnerabilities. Please see the links for additional information...

Updated jbig2dec packages fix security vulnerabilities

Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2error at /jbig2dec/jbig2.c. CVE-2023-46361 An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input. CVE-2026-3807...

Updated c-ares packages fix security vulnerabilities

Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo over TCP. CVE-2026-33630 CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. CVE-2026-69184 Memory-amplification denial of service via unvalidated DNS header...

Updated postgresql18 & postgresql15 packages fix security vulnerabilities

psql COPY FROM STDIN early failure processes data lines as psql commands. CVE-2026-6464 ALTER TABLE ALTER TYPE resets extended statistics ownership. CVE-2026-6469 Fails to check type USAGE privilege. CVE-2026-6470 Logical decoding can dlopen arbitrary file. CVE-2026-6471 tsvector and tsquery...

Updated nspr, nss, & firefox packages fix security vulnerabilities

Site isolation issue in the Graphics: CanvasWebGL component. CVE-2026-74934 Privilege escalation in the DOM: Networking component. CVE-2026-74935 Use-after-free in the JavaScript: WebAssembly component. CVE-2026-74936 Use-after-free in the JavaScript: GC component. CVE-2026-74937 Mitigation bypas...