10560 matches found
CLSA-2023-1702573569 Fix of 5 CVEs
SECURITY UPDATE: Update to 5.7.44 to fix security issues - CVE-2023-22053, CVE-2023-22084, CVE-2023-22015, CVE-2023-22026, CVE-2023-22028 debian/patches/offroottests.patch: disable mysqlddaemon and mysqldsafe tests under root due to known issues with these tests...
CLSA-2023-1693904659 Fix of 11 CVEs
Jammy update: v5.15.86 upstream stable release LP: 2005113 // CVE-url: https://ubuntu.com/security/CVE-2022-3606 - libbpf: Fix null-pointer dereference in findprogbysecinsn Jammy update: v5.15.87 upstream stable release LP: 2007441 // CVE-url: https://ubuntu.com/security/CVE-2023-23454 - net:...
CLSA-2023-1688679460 Update of tzdata
Upgrade to tzdata-2023c code and data are identical to 2023a - Egypt now uses DST again, from April through October. - This year Morocco springs forward April 23, not April 30. - Palestine delays the start of DST this year. - Much of Greenland still uses DST from 2024 on. - America/Yellowknife...
CLSA-2023-1683146027 kernel: Fix of 23 CVEs
media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-26545 - net/ulp: prevent ULP without clone op from entering the LISTEN status CVE-2023-0461 - Bluetooth: L2CAP: Fix u8 overflow CVE-2022-45934 -...
CLSA-2023-1678136294 httpd: Fix of 2 CVEs
CVE-2022-37436: modproxy: HTTP response splitting - CVE-2006-20001: moddav: out-of-bounds read/write...
CLSA-2022-1656447241 Fixed CVEs in httpd: CVE-2022-31813, CVE-2022-28615, CVE-2022-26377
CVE-2022-26377: modproxyajp: fix HTTP request smuggling - CVE-2022-28615: fix possible out-of-bounds read in apstrcmpmatch - CVE-2022-31813: modproxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded- headers correctly...
CLSA-2022-1650576075 Fix of 13 CVEs
CKSIX-267: USB: hso: Fix OOB memory access in hsoprobe/hsogetconfigdata - CKSIX-267: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch - CKSIX-267: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgaconinvertregion - CKSIX-267: CVE-2020-14331: vgacon: Fix for...
CLSA-2022-1650377026 Fix of CVE: CVE-2021-3609, CVE-2022-28390
can: emsusb: emsusbstartxmit: fix double devkfreeskb in error path ELSCVE-3847 CVE-2022-28390 - can: bcm: delay release of struct bcmop after synchronizercu ELSCVE-1694 CVE-2021-3609...
CLSA-2021-1634925483 Fixed CVEs in python: CVE-2018-20852, CVE-2020-8492, CVE-2020-26116, CVE-2020-27619
Add Oracle Linux distribution in platform.py - CVE-2018-20852: Prefix dot in domain for proper subdomain validation - CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client - CVE-2020-26116: http.client allows CRLF injection if...
CLSA-2026-1788201541 TuxCare security update for org.springframework (17 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 17 CVEs. Fixed in 6.2.19-tuxcare.1...
CLSA-2026-1787928056 TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 14 CVEs. Fixed in 6.1.21-tuxcare.11...
CLSA-2026-1777941830 TuxCare security update for 5 packages (11 CVEs)
TuxCare rebuilt 5 packages to address 11 CVEs. Fixed in 2.10.15-tuxcare.1...
CLSA-2026-1779358954 expat: Fix of CVE-2026-45186
CVE-2026-45186: fix quadratic runtime in attribute collision detection by using a hash table for default attribute names instead of an On^2 loop...
CLSA-2026-1778786567 curl: Fix of 2 CVEs
CVE-2018-1000120: fix buffer overflow exists in the FTP URL handling - CVE-2018-1000007: fix leak authentication data to third parties in HTTP requests...
CLSA-2026-1778604245 samba: Fix of CVE-2022-32742
CVE-2022-32742: fix server memory information leak via SMB1; insufficient range-check on SMB1 write request length allowed server memory contents to leak into the written file or printer instead of client-supplied bytes...
CLSA-2026-1778238289 frr: Fix of 4 CVEs
CVE-2022-43681: fix bgpd crash on malformed BGP OPEN messages with insufficient data - CVE-2022-40318: fix out-of-bounds read in bgpopenoptionparse with extended option params - CVE-2023-31489: fix out-of-bounds read in BGP Long-lived Graceful-Restart capability parsing - CVE-2023-46752: fix bgpd...
CLSA-2026-1778219103 glib2: Fix of CVE-2025-4373
CVE-2025-4373 fix buffer underflow in gstringinsertunichar and other GString APIs by carefully handling gssize parameters in glib/gstring.c...
CLSA-2026-1778175067 cyrus-sasl: Fix of CVE-2019-19906
CVE-2019-19906: fix off-by-one in sasladdstring lib/common.c that could cause denial of service or information disclosure via crafted input...
CLSA-2026-1778173027 dovecot: Fix of CVE-2026-27858
CVE-2026-27858: fix unbounded memory allocation in managesieve-login when AUTHENTICATE initial response literal size is excessively large...
CLSA-2026-1778166693 Update of cups
Merge of the Amazon Linux 2 cups package cups-1.6.3-51.amzn2.0.9...
CLSA-2026-1772575666 containernetworking-plugins: Fix of 3 CVEs
rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE - CVE-2025-61729: fix excessive resource consumption when constructing hostname error messages for certificates with many SANs - CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory...
CLSA-2026-1777969863 gd: Fix of CVE-2021-40145
CVE-2021-40145: fix double free in gdImageGd2Ptr...
CLSA-2026-1777969446 binutils: Fix of 8 CVEs
CVE-2021-45078: fix heap-based buffer overflow in stabxcoffbuiltintype - CVE-2021-46174: fix buffer overflow in readsectionstabsdebugginginfo - CVE-2022-44840: fix heap buffer overflow in findsectioninset - CVE-2022-45703: fix heap buffer overflow in displaygdbindex - CVE-2022-47695: fix...
CLSA-2026-1777637310 Fix of 13 CVEs
CVE-2026-31431 - crypto: authencesn - reject too-short AAD assoclen8 to match ESP/ESN spec CVE-2026-31431 - crypto: scatterwalk - Backport memcpysglist CVE-2026-31431 - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption CVE-2026-31431 - crypto: authencesn - Fix src...
CLSA-2026-1777636990 Fix of 9 CVEs
CVE-2026-31431 - crypto: scatterwalk - Backport memcpysglist CVE-2026-31431 - crypto: algifaead - use memcpysglist instead of null skcipher CVE-2026-31431 - crypto: algifaead - Revert to operating out-of-place CVE-2026-31431 - crypto: algifaead - snapshot IV for async AEAD requests CVE-2026-31431...
CLSA-2026-1777322146 jq: Fix of CVE-2026-32316
CVE-2026-32316: fix heap buffer overflow in jvpstringappend and jvpstringcopyreplacebad caused by uint32t overflow in size calculations for strings exceeding INTMAX bytes...
CLSA-2026-1777308938 gdb: Fix of CVE-2019-1010180
CVE-2019-1010180: add warning for corrupt ELF section size larger than file...
CLSA-2026-1777035524 libsoup: Fix of CVE-2026-5119
CVE-2026-5119: do not send cookies to a HTTP proxy for a HTTPS request...
CLSA-2026-1776972009 php: Fix of 3 CVEs
CVE-2021-21707: fix NUL byte truncation in XML/DOM URI file loading - CVE-2022-31628: fix phar wrapper denial of service when loading compressed quine archives - CVE-2022-31629: discard HTTP variables that mangle into Host- or Secure- prefixes...
CLSA-2026-1776777715 gstreamer1-plugins-good: Fix of 2 CVEs
CVE-2026-3083, CVE-2026-3085: disable rtpqdm2depay element to fix heap buffer overflow and out-of-bounds write via crafted RTP payloads...
CLSA-2026-1776361748 Fix CVE(s): CVE-2026-0968
SECURITY UPDATE: heap read past bounds in sftpparselongname from malicious SFTP longname field - debian/patches/CVE-2026-0968.patch: validate longname pointer and longnamefield; bound string walks at NUL; fail if field not found - CVE-2026-0968...
CLSA-2026-1770310264 java-1.8.0-openjdk: Fix of 3 CVEs
Upgrade to shenandoah-jdk8u482-b08 GA fixing the following CVE: - CVE-2026-21945: enhance certificate checking - CVE-2026-21925: improve JMX connections - CVE-2026-21933: improve HttpServer request handling...
CLSA-2026-1775749572 ImageMagick: Fix of 4 CVEs
CVE-2026-25968: stack buffer overflow in MSL image-processing language via WriteMSLImage recursion - CVE-2026-25897: out-of-bounds heap write in SUN decoder on 32-bit systems via integer overflow in pixel buffer allocation - CVE-2025-53014: out-of-bounds read in InterpretImageFilename when...
CLSA-2026-1775723090 python-pip: Fix of 2 CVEs
CVE-2025-66471: add decompression size limit to bundled urllib3 - CVE-2026-21441: skip decompression when draining redirect responses in bundled urllib3...
CLSA-2026-1775657177 kernel: Fix of 9 CVEs
ovl: Filter invalid inodes with missing lookup function CVE-2024-56570 - ALSA: aloop: Fix racy access at PCM trigger CVE-2026-23191 - media: imon: reorganize serialization CVE-2025-39993 - usb: xhci: Fix inverted ringxrunevent check in handletxevent CVE-2025-37882 - Revert "VFS: Impose ordering...
CLSA-2026-1775033648 postgresql-jdbc: Fix of CVE-2022-21724
CVE-2022-21724: ensure arbitrary classes can't be passed instead of SocketFactory, SSLSocketFactory, CallbackHandler, HostnameVerifier - Restore testing from previous spec versions, exclude broken tests...
CLSA-2026-1774432816 vim: Fix of 2 CVEs
CVE-2026-28417: fix OS command injection in netrw plugin when handling specially crafted URLs such as scp:// - CVE-2026-28421: fix heap-buffer-overflow and crash when recovering from a maliciously crafted Vim swap file...
CLSA-2026-1773683117 gimp: Fix of 4 CVEs
CVE-2026-2044: fix uninitialized memory read in PGM file parser - CVE-2026-2045: fix heap buffer overflow in XWD file loader - CVE-2026-2048: fix out-of-bounds write in XWD file loader - CVE-2026-0797: fix missing fread return value checks in ICO file loader...
CLSA-2026-1773323876 go-rpm-macros: Fix of CVE-2025-61726
rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE - CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing...
CLSA-2026-1773314910 git-lfs: Fix of 3 CVEs
rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE - CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys...
CLSA-2026-1773313831 delve: Fix of CVE-2025-68121
Rebuild with golang 1.22.9-1.el92.tuxcare.els6 to fix CVE-2025-68121 - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry...
CLSA-2026-1772454796 zlib: Fix of CVE-2016-9843
CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation...
CLSA-2026-1772573053 butane: Fix of CVE-2025-61729
rebuilt with golang = 1.25.7-1.tuxcare.els1 to address the following security issues: - CVE-2025-61729...
CLSA-2026-1771009339 Update of nss
update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go...
CLSA-2026-1769621572 python2: Fix of CVE-2025-12084
CVE-2025-12084: fix quadratic algorithm when building nested elements with xml.dom.minidom appendChild method...
CLSA-2026-1769598671 libsoup: Fix of CVE-2025-14523
CVE-2025-14523: reject duplicate Host headers to prevent request smuggling, cache poisoning, and host-based access control bypass attacks...
CLSA-2025-1765898379 java-1.8.0-openjdk: Fix of 2 CVEs
Upgrade to shenandoah-jdk8u472-b08 GA fixing the following CVEs: - CVE-2025-53057: enhance certificate handling - CVE-2025-53066: enhance Path Factories...
CLSA-2025-1763031933 libxml2: Fix of 3 CVEs
CVE-2025-9714: additional fixes - CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in valid.c - CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c...