ALSA-2026:61242 Important: mingw-sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

ALSA-2026:61316 Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

ALSA-2026:61248 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2026:61340 Moderate: dbus-broker security update

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features...

ALSA-2026:61247 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via...

ALSA-2026:61623 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

ALSA-2026:61625 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

ALSA-2026:61241 Moderate: pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref CVE-2026-14324 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages...

ALSA-2026:61386 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion...

ALSA-2026:61378 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP...

ALSA-2026:61680 Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via...

ALSA-2026:61581 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

ALSA-2026:60305 Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadrati...

ALSA-2026:60226 Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

ALSA-2026:60004 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

ALSA-2026:60215 Moderate: assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 For more details about the security issues, including the impact, a...

ALSA-2026:60306 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

ALSA-2026:60394 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2026:60304 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

ALSA-2026:59997 Moderate: polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fixes: polkit: Polkit: Denial of Service via unbounded input processing through standard...

ALSA-2026:59723 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ksm: use range-walk function to jump over holes in scangetnextrmapitem CVE-2025-68211 kernel: ip6tunnel: use skbvlaninetprepare in ip6tnlrcv CVE-2026-23003 kernel: netfilter:...

ALSA-2026:60329 Low: mingw-openssl security update

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows MinGW libraries and development tools. Security Fixes:...

ALSA-2026:59821 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64 decode CVE-2026-63886 kernel: netfilter: conntrack: tcp:...

ALSA-2026:59972 Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gstreamer: GStreamer: Remote Code Execution via...

ALSA-2026:59737 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64...

ALSA-2026:59241 Important: python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:59379 Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

ALSA-2026:59490 Important: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

ALSA-2026:59347 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

ALSA-2026:59380 Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

ALSA-2026:59362 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

ALSA-2026:59372 Moderate: assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 For more details about the security issues, including the impact, a...

ALSA-2026:59387 Moderate: mod_http2 security, bug fix, and enhancement update

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: modhttp2: Apache HTTP Server modhttp2: Use After Free vulnerability allows arbitrary code execution or denial of service. CVE-2026-48913 httpd: Apache HTTP Server:...

ALSA-2026:59496 Important: nginx:1.26 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

ALSA-2026:59243 Important: python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:59242 Important: python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:59487 Important: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow...

ALSA-2026:59133 Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gstreamer: GStreamer: Remote Code Execution via MRF fil...

ALSA-2026:58938 Important: sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

ALSA-2026:58562 Important: python-urwid security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:59216 Important: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

ALSA-2026:58560 Moderate: cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS distribution but is now maintained independently. Security Fixes: libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PN...

ALSA-2026:58952 Important: python-urwid security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:58971 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:59220 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

ALSA-2026:58936 Important: sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

ALSA-2026:58819 Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

ALSA-2026:58561 Important: python-urwid security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:58571 Moderate: qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fixes: qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling...

ALSA-2026:58901 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...