CLSA-2024-1729874131 kernel: Fix of 43 CVEs

drm/amdgpu: Validate TA binary size CVE-2024-44977 - drm/amd/display: Avoid overflow from uint32t to uint8t CVE-2024-47661 - scsi: lpfc: Handle mailbox timeouts in lpfcgetsfpinfo CVE-2024-46842 - ALSA: line6: Fix racy access to midibuf CVE-2024-44954 - exec: Fix ToCToU between perm check and...

CLSA-2024-1727167500 kernel: Fix of 11 CVEs

wifi: mac80211: Avoid address calculations via out of bounds array indexing CVE-2024-41071 - bnx2x: Fix multiple UBSAN array-index-out-of-bounds CVE-2024-42148 - exec: Fix ToCToU between perm check and set-uid/gid usage CVE-2024-43882 - scsi: aacraid: Fix double-free on probe failure...

CLSA-2024-1726058957 java-1.8.0-openjdk: Fix of 6 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u422-b05. That fixes following CVEs: - CVE-2024-21131: UTF8 size overflow - CVE-2024-21138: Infinite loop vunlerability in SymbolTable - CVE-2024-21140: Int overflow/underflow in Range Check Elimination RCE - CVE-2024-21144: Invalid header...

CLSA-2024-1724266264 grub2: Fix of 12 CVEs

Fix package version number - Use CloudLinux vendor cert - Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel - Add patches from centos-8.5 ELS: - CVE-2021-3695: out-of-bounds write in the heap area by a crafted 16-bit grayscale PNG image -...

CLSA-2024-1723809128 Fix of 39 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-36939 - NFS: Cleanup - add nfsclientsexit to mirror nfsclientsinit - nfs: expose /proc/net/sunrpc/nfs in net namespaces - sunrpc: add a struct rpcstats arg to rpccreateargs - nfs: make the rpcstat per net namespace - nfs: Handle error of rpcprocregist...

CLSA-2024-1723495305 Fix of 19 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-42068 - bpf: Take return from setmemoryro into account with bpfproglockro CVE-url: https://ubuntu.com/security/CVE-2024-42079 - gfs2: Fix NULL pointer dereference in gfs2logflush CVE-url: https://ubuntu.com/security/CVE-2024-42226 - usb: xhci: prevent...

CLSA-2024-1718950178 Fix of 22 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26764 - aio: remove an outdated BUGON and comment in aiocomplete - aio: remove the extra getfile/fput pair in iosubmitone - aio: refactor read/write iocb setup - fs/aio: Restrict kiocbsetcancelfn to I/O submitted via libaio CVE-url:...

CLSA-2024-1715951065 kernel: Fix of 10 CVEs

scsi: lpfc: Fix use-after-free in lpfcunregrpi routine CVE-2021-47198 - fs,hugetlb: fix NULL pointer dereference in hugetlbsfillsuper CVE-2024-0841 - bpf: Fix incorrect verifier pruning due to missing register precision taints CVE-2023-2163 - bpf: Fix hashtab overflow check on 32-bit arches...

CLSA-2024-1714073581 Fix of 16 CVEs

Jammy update: v5.15.81 upstream stable release LP: 2003130 // CVE-url: https://ubuntu.com/security/CVE-2023-1382 - tipc: set con sock in tipcconnalloc - tipc: add an extra connget in tipcconnalloc CVE-url: https://ubuntu.com/security/CVE-2023-1998 - x86/speculation: Allow enabling STIBP with lega...

CLSA-2023-1703612912 openssh: Fix of CVE-2023-51385

CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...

CLSA-2023-1702573569 Fix of 5 CVEs

SECURITY UPDATE: Update to 5.7.44 to fix security issues - CVE-2023-22053, CVE-2023-22084, CVE-2023-22015, CVE-2023-22026, CVE-2023-22028 debian/patches/offroottests.patch: disable mysqlddaemon and mysqldsafe tests under root due to known issues with these tests...

CLSA-2023-1699380056 rsync: Fix of 2 CVEs

CVE-2018-25032: fix a bug that can crash deflate on some input when using ZFIXED - CVE-2022-37434: fix zlib bug with a large gzip header extra field...

CLSA-2023-1698179598 Fix CVE(s): CVE-2023-45853

SECURITY UPDATE: Reject overflows of zip header fields in minizip - debian/patches/CVE-2023-45853.patch: Check length of comment, filename and extra field in zipOpenNewFileInZip464 - CVE-2023-45853...

CLSA-2023-1697742241 Fix CVE(s): CVE-2023-44487

SECURITY UPDATE: The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly - debian/patches/CVE-2023-44487.patch: HTTP/2 - per-iteration stream handling limit. - CVE-2023-44487...

CLSA-2023-1689009164 Fix CVE(s): CVE-2022-29404

SECURITY UPDATE: modlua may denial of service in r:parsebody0 - debian/patches/CVE-2022-29404.patch: use a liberal default limit for LimitRequestBody of 1GB to prevent a denial of service caused by a malicious lua script request - CVE-2022-29404...

CLSA-2023-1681288130 Update of microcode_ctl

Update Intel CPU microcode to microcode-20230214 release: - Addition of 06-6c-01/0x10 microcode in microcode.dat at revision 0x1000211; - Addition of 06-8f-04/0x10 microcode in microcode.dat at revision 0x2c000170; - Addition of 06-8f-04/0x87 microcode in microcode.dat at revision 0x2b000181; -...

CLSA-2022-1668705928 httpd: Fix of 2 CVEs

CVE-2022-28614: handle large writes in aprputs - CVE-2022-29404: use a liberal default limit for LimitRequestBody of 1GB...

CLSA-2022-1658171496 Fixed CVEs in openssl: CVE-2022-1292, CVE-2022-2068

CVE-2022-1292: crehash: Do not use shell to invoke openssl to prevent command injection - CVE-2022-2068: crehash: Fix file operations to prevent command injection - Update expired SCT certificates...

CLSA-2022-1656447241 Fixed CVEs in httpd: CVE-2022-31813, CVE-2022-28615, CVE-2022-26377

CVE-2022-26377: modproxyajp: fix HTTP request smuggling - CVE-2022-28615: fix possible out-of-bounds read in apstrcmpmatch - CVE-2022-31813: modproxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded- headers correctly...

CLSA-2022-1655317984 Fixed CVE-2022-22576 in curl

CVE-2022-22576: check additional SASL parameters for connection reuse...

CLSA-2022-1654175372 Fixed CVE-2022-24070 in subversion-4.module_el8.4.0+2052+ac338b6d.tuxcare.els1

CVE-2022-24070: fix use-after-free of object-pools when used as httpd module...

CLSA-2022-1651146021 Fix of CVE: CVE-2022-0617, CVE-2021-40490, CVE-2021-29154, CVE-2022-0435, CVE-2021-4154, CVE-2021-3753, CVE-2021-38160, CVE-2021-45485, CVE-2021-3752, CVE-2021-41864, CVE-2021-4083, CVE-2021-26930

udf: Restore ilenAlloc when inode expansion fails Jan Kara CVE-2022-0617 - udf: Fix NULL ptr deref when converting from inline format Jan Kara CVE-2022-0617 - Bluetooth: fix use-after-free error in locksocknested Wang ShaoBo CVE-2021-3752 - vtkdsetmode: extend console locking Linus Torvalds...

CLSA-2022-1646060645 Fix of CVE: CVE-2021-23017

CVE-2021-23017: Off-by-one in ngxresolvercopy when labels are followed by a pointer to a root domain name...

CLSA-2022-1645466754 Fix of CVE: CVE-2021-43527

CVE-2021-43527: nss: Memory corruption in decodeECorDsaSignature with DSA signatures and RSA-PSS - Pin validation date for PayPalEE test cert...

CLSA-2021-1632261812 Fix of CVE: CVE-2020-25211, CVE-2020-25656, CVE-2019-19532, CVE-2020-29661

CKSIX-277: CVE-2020-29661: tty: Fix -pgrp locking in tiocspgrp - CKSIX-277: CVE-2020-25656: vt: keyboard, extend funcbuflock to readers - CKSIX-277: CVE-2020-25656: tty/vt: fix write/write race in ioctlKDSKBSENT handler - CKSIX-277: CVE-2020-25656: vt: keyboard, simplify vtkdgkbsent - CKSIX-277:...

CLSA-2021-1632261664 Fix of CVE: CVE-2021-27364, CVE-2021-27363, CVE-2021-27365

CVE-2021-27365: scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE - CVE-2021-27365: scsi: iscsi: Verify lengths on passthrough PDUs - CVE-2021-27363: CVE-2021-27364: scsi: iscsi: Restrict sessions and handles to admin capabilities - sysfs: Add sysfsemit and sysfsemitat to format sysfs...

CLSA-2020-1605798462 Fix of 227 CVE

Fix bug 69720: Null pointer dereference in phargetfpoffset - Fix bug 70728: Type Confusion Vulnerability in PHPtoXMLRPCworker - Fix bug 70661: Use After Free Vulnerability in WDDX Packet Deserialization - Fix bug 70741: Session WDDX Packet Deserialization Type Confusion Vulnerability - Fix bug...

CLSA-2026-1790854662 TuxCare security update for nodemailer (4 CVEs)

TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.1.0-tuxcare.4...

CLSA-2026-1787928056 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 14 CVEs. Fixed in 6.1.21-tuxcare.11...

CLSA-2026-1787300455 TuxCare security update for django (11 CVEs)

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.9.post3+tuxcare...

CLSA-2026-1786361876 TuxCare security update for minimatch (5 CVEs)

TuxCare rebuilt minimatch to address 5 CVEs. Fixed in 0.2.5-tuxcare.1...

CLSA-2026-1784769506 TuxCare security update for nuxt (1 CVE)

TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.3-tuxcare.6...

CLSA-2026-1784077475 TuxCare security update for monolog/monolog (1 CVE)

TuxCare rebuilt monolog/monolog to address 1 CVE. Fixed in 1.11.0-p1+tuxcare...

CLSA-2026-1776127989 TuxCare security update for saloonphp/saloon (3 CVEs)

TuxCare rebuilt saloonphp/saloon to address 3 CVEs. Fixed in 3.15.0-p1+tuxcare...

CLSA-2026-1778114663 TuxCare security update for xmldom (1 CVE)

TuxCare rebuilt xmldom to address 1 CVE. Fixed in 0.6.0-tuxcare.3...

CLSA-2026-1780132159 Fix of 7 CVEs

CVE-2026-23193 - scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount CVE-2026-23193 CVE-2025-71093 - e1000: fix OOB in e1000tbishouldaccept CVE-2025-71093 CVE-2025-71116 - libceph: make decodepool more resilient against corrupted osdmaps CVE-2025-71116 CVE-2025-71136 - media:...

CLSA-2026-1779357393 curl: Fix of CVE-2026-5773

CVE-2026-5773: disable connection reuse for SMBS to prevent libcurl from reusing a connection to the same server for a different SMB share...

CLSA-2026-1779298645 postfix: Fix of CVE-2026-43964

CVE-2026-43964: fix buffer over-read in dsnsplit when an enhanced status code is not followed by other text...

CLSA-2026-1779183996 expat: Fix of CVE-2026-45186

CVE-2026-45186: fix quadratic complexity in attribute name collision check...

CLSA-2026-1779179460 kernel: Fix of CVE-2026-46333

ptrace: require CAPSYSPTRACE when task has no mm CVE-2026-46333...

CLSA-2026-1778979189 Fix CVE(s): CVE-2024-6232, CVE-2024-7592, CVE-2024-9287

SECURITY UPDATE: ReDoS in tarfile PAX header parsing - debian/patches/CVE-2024-6232.patch: rewrite Lib/tarfile.py PAX-record parser to scan length-prefixed records via a bounded regex headerlengthprefixre plus direct slicing, eliminating quadratic backtracking in three pre-existing regexes. Adapt...

CLSA-2026-1778789558 httpd: Fix of CVE-2022-36760

CVE-2022-36760: modproxyajp: fix possible request smuggling via invalid Transfer-Encoding...

CLSA-2026-1778769563 python: Fix of 4 CVEs

CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection - CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new validatehost helper to prevent CRLF header injection the glibc...

CLSA-2026-1778247114 libssh2: Fix of CVE-2026-7598

CVE-2026-7598: fix integer overflow in userauthpassword CVE-2026-7598...

CLSA-2026-1778604245 samba: Fix of CVE-2022-32742

CVE-2022-32742: fix server memory information leak via SMB1; insufficient range-check on SMB1 write request length allowed server memory contents to leak into the written file or printer instead of client-supplied bytes...

CLSA-2026-1778254382 buildah: Fix of CVE-2026-25679

rebuild on tuxcare9.6esu with newer golang version 1.25.7-1.el96.tuxcare.els2 to fix the following CVE: - CVE-2026-25679: fix insufficient validation of host/authority component in url.Parse - split golang BuildRequires by .el96 so each ELS platform pulls its own fixed golang version el96 -...

CLSA-2026-1778152899 httpd: Fix of 2 CVEs

CVE-2017-15710: modauthnzldap out-of-bounds write when accept-language header value is shorter than two characters - CVE-2017-15715: regex anchor in / can match before an embedded newline, allowing .htaccess bypass of trailing-extension filters...

CLSA-2026-1778129870 nginx: Fix of 2 CVEs

CVE-2026-27651: fix null pointer dereference in ngxmailauthhttpmodule when authentication retry is enabled with CRAM-MD5 or APOP - CVE-2026-32647: fix buffer over-read/write in ngxhttpmp4module when processing crafted mp4 files with empty stco/co64 atoms...

CLSA-2026-1778127227 pcp: Fix of 2 CVEs

CVE-2024-45770: guard pmpost against symlink attacks on $PCPLOGDIR/NOTICES - CVE-2024-45769: harden libpcp pmDecodeValueSet to prevent heap corruption from crafted PDUs...

CLSA-2026-1778112033 avahi: Fix of CVE-2026-24401

CVE-2026-24401: fix avahi-daemon crash on receipt of unsolicited mDNS responses containing self-referencing CNAME records by detecting CNAME loops in lookuphandlecname to prevent uncontrolled recursion and stack exhaustion; also includes two related DoS fixes in the same lookup path from upstream...