10560 matches found
CLSA-2026-1777543457 webkit2gtk3: Fix of 9 CVEs
Update to 2.50.6 to fix the following vulnerabilities WSA-2026-0001: - CVE-2025-43213: type confusion in JavaScriptCore fixed in 2.50.5 - CVE-2025-43214: out-of-bounds read in WebCore fixed in 2.50.5 - CVE-2025-43457: integer overflow in WebKit canvas rendering fixed in 2.50.6 - CVE-2025-43511:...
CLSA-2026-1777475754 glusterfs: Fix of 2 CVEs
CVE-2018-10923: posix: disable open/read/write on special files - CVE-2018-14651: server: don't allow '/' in basename...
CLSA-2026-1777453233 Fix CVE(s): CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945
OpenJDK 11.0.30 release, build 7. - CVE-2026-21925: Improve JMX connections - CVE-2026-21932: Enhance handling of URIs AWT/JavaFX - CVE-2026-21933: Improve HttpServer request handling - CVE-2026-21945: Enhance certificate checking - Release notes:...
CLSA-2026-1777446517 squid: Fix of 3 CVEs
CVE-2019-12521: fix ESI parser off-by-one heap overflow by enforcing a stack-depth limit and throwing on overflow - CVE-2019-12524 already addressed by the CVE-2019-12520 backport same fix upstream; see Squid advisory SQUID-2019:4...
CLSA-2026-1777445847 grafana-pcp: Fix of CVE-2026-25679
Rebuild against recent Go compiler - CVE-2026-25679: fix net/url insufficient validation of host in url.Parse...
CLSA-2026-1777394614 nodejs: Fix of 3 CVEs
CVE-2022-25883: fix ReDoS in bundled npm semver new Range and parseComparator caused by unbounded whitespace expansion in version ranges - CVE-2026-21710: fix HTTP prototype pollution in http.get/request via headersDistinct option by using null-prototype objects for header storage -...
CLSA-2026-1777308690 python3: Fix of CVE-2026-1299
CVE-2026-1299: reject newline injection in email module's BytesGenerator when serializing headers - Skip test.testxmletree.XMLPullParserTest.testsimplexml during RPM build; unrelated expat-2.1.0-15.0.7.tuxcare.els1 regression breaks XMLPullParser chunked-feed semantics in TuxCare ELS el7 build...
CLSA-2026-1776937700 mysql: Fix of CVE-2019-2627
CVE-2019-2627: fix crash when mysql.user table has missing password column...
CLSA-2026-1777052042 sqlite: Fix of CVE-2018-8740
CVE-2018-8740: avoid a NULL pointer dereference when the sqlitemaster schema contains a corrupt CREATE TABLE AS entry...
CLSA-2026-1776966842 go-rpm-macros: Fix of CVE-2026-25679
CVE-2026-25679: rebuild against golang-1.25.7-1.tuxcare.els2 which contains the net/url IPv6 host-literal parsing fix...
CLSA-2026-1776963378 binutils: Fix of 8 CVEs
CVE-2022-47007: fix memory leak in stabdemanglev3arg - CVE-2022-47008: fix memory leak in maketempdir and maketempname - CVE-2022-47011: fix memory leak in parsestabstructfields - CVE-2022-47010: fix memory leak in prfunctiontype - CVE-2022-48063: fix excessive memory allocation in...
CLSA-2026-1776848113 gimp: Fix of 2 CVEs
CVE-2026-2239: fix heap-buffer-overflow in freadpascalstring when processing PSD files and a follow-up NULL pointer dereference in loadresource1006 alpha names handling - CVE-2026-2272: fix integer overflow in ICO file loading...
CLSA-2026-1776354546 jq: Fix of CVE-2024-23337
CVE-2024-23337: fix signed integer overflow in jvparraywrite and jvpobjectrehash that could lead to SEGV on growing arrays and objects...
CLSA-2026-1776179155 Fix of 8 CVEs
SECURITY UPDATE: fix division by zero in YUV coder - debian/patches/CVE-2026-25799.patch: fix division by zero in YUV coder - CVE-2026-25799 SECURITY UPDATE: fix NULL pointer dereference in SFW coder - debian/patches/CVE-2026-25795.patch: fix NULL pointer dereference in SFW coder - CVE-2026-25795...
CLSA-2026-1775731413 libxml2: Fix of 8 CVEs
CVE-2023-45322: fix use-after-free in xmlStaticCopyNodeList when copying DTDs - CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint - CVE-2025-6170: fix potential buffer overflows in xmllint interactive shell - CVE-2025-8732: fix stack overflow from self-referencing SGML...
CLSA-2026-1774612633 gnupg2: Fix of CVE-2025-30258
CVE-2025-30258: fix verification DoS due to a malicious subkey in the keyring...
CLSA-2026-1774375498 Update of alt-php
New microcode update packages from upstream up to 2026-02-21: - Addition AMD CPU microcode for processor family 0x1a: cpuid:0x00B00F21ver:0x0B002161, cpuid:0x00B00F81ver:0x0B008121, cpuid:0x00B10F10ver:0x0B101058, cpuid:0x00B20F40ver:0x0B204037, cpuid:0x00B40F40ver:0x0B404035,...
CLSA-2026-1774369958 openssh: Fix of CVE-2026-3497
CVE-2026-3497: replace incorrect use of sshpktdisconnect with sshpacketdisconnect and properly initialize variables...
CLSA-2026-1774259220 curl: Fix of 3 CVEs
CVE-2026-1965: fix incorrect connection reuse; prevent reuse of Negotiate- authenticated connections with different credentials and require authentication identity match - CVE-2026-3784: fix wrong proxy connection reuse with different credentials; check proxy user/password in proxyinfomatches to...
CLSA-2026-1773830081 libvpx: Fix of CVE-2026-2447
CVE-2026-2447: fix heap buffer overflow in writesuperframeindex...
CLSA-2026-1773782865 Update of alt-php
New microcode update packages from upstream up to 2026-02-21: - Addition AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A00F11ver:0x0A0011D5, cpuid:0x00A00F11ver:0x0A0011DE, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A00F12ver:0x0A001247,...
CLSA-2026-1770214504 Update of microcode_ctl
Update Intel CPU microcode to 20251111: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000410; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000650; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...
CLSA-2026-1772644297 Update of ca-certificates
update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go Daddy Class 2 CA" - Certificate "Starfield Class...
CLSA-2026-1772576264 containernetworking-plugins: Fix of 3 CVEs
rebuild with newer golang version 1.25.7-1.el96.tuxcare.els1 to fix the following CVEs - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry - CVE-2025-61726: limit parsed URL query parameters to...
CLSA-2026-1772450608 libpng15: Fix of CVE-2026-25646
CVE-2026-25646: fix heap buffer overflow in pngsetquantize caused by stale palette indices in the color distance hash table...
CLSA-2026-1772448200 grafana: Fix of 3 CVEs
rebuild with golang 1.25.7 which fixes the following CVEs - - CVE-2025-61726: fix DoS due to memory exhaustion flaw in net/url parameter parsing - CVE-2025-61728: fix DoS due to CPU exhaustion flaw in archive/zip indexing - CVE-2025-61729: fix DoS due to CPU exhaustion flaw in crypto/x509...
CLSA-2026-1772101499 httpd: Fix of CVE-2024-42516
CVE-2024-42516: fix HTTP response splitting by reordering header validation to occur after full response header assembly...
CLSA-2026-1771412755 Update of alt-php
Update ca-certificates database to 20260210: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.82. - The following certificates were updated: Certificate "Entrust Root Certification Authority" Certificate "ePKI Root Certification Authority" Certificate...
CLSA-2026-1771010063 Update of nss
update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - added certificates: - Certificate "TrustAsia SMIME ECC Root CA" - Certificate "TrustAsia SMIME RSA Root CA" - Certificate "TrustAsia TLS ECC Root CA" - Certificate "TrustAsia TLS RSA...
CLSA-2026-1770216461 Update of alt-php
New microcode update packages from upstream up to 2025-11-11: - New microcodes: sig 0x000a06e1, pfmask 0x97, 2025-06-27, rev 0x1000273, size 1635328 - Updated microcodes: sig 0x000606a6, pfmask 0x87, 2025-03-11, rev 0xd000410, size 309248 sig 0x000606c1, pfmask 0x10, 2025-03-06, rev 0x10002e0, si...
CLSA-2026-1770215200 Update of microcode_ctl
Update Intel CPU microcode to 20251111: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000410; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000650; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...
CLSA-2026-1770040871 Fix CVE(s): CVE-2023-4781
Fix CVE-2023-4781.patch - debian/patches/CVE-2023-4781.patch: patch winexchange instead of winrotate...
CLSA-2026-1770035896 python3.11-urllib3: Fix of CVE-2025-66471
CVE-2025-66471: fix improper handling of highly compressed data in the Streaming API...
CLSA-2026-1768565904 libpq: Fix of CVE-2025-12818
Update to 13.23 - CVE-2025-12818: fix integer overflow in allocation-size calculations...
CLSA-2026-1768556662 cups: Fix of CVE-2025-58436
CVE-2025-58436: fix unresponsive cupsd process caused by a slow client...
CLSA-2026-1768223578 git: Fix of CVE-2024-32021
CVE-2024-32021: fix symlink bypass, abort when hardlinked source and target file differ...
CLSA-2026-1767799061 expat: Fix of 3 CVEs
Rebase to version 2.5.0 - CVE-2024-28757: prevent billion laughs attacks in isolated external parser part of 839, reject direct parameter entity recursion part of 839 - CVE-2025-59375: fix memory amplification and add allocation tracker - CVE-2013-0340: properly handle entities expansion...
CLSA-2025-1765287627 Update of postgresql
Bump release to 9.2.24-9.0.3.tuxcare.els1...
CLSA-2025-1764858279 jackson-databind: Fix of 2 CVEs
Removed CVE-2020-36518.patch: jackson-databind 2.14.1-1 is not affected - Rebuilt with the CVE-2025-52999: fixed jackson-core version...
CLSA-2025-1764322066 gstreamer1: Fix of CVE-2024-47606
CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem - Fix documentation build with the newer gtk-doc...
CLSA-2025-1764027165 xorg-x11-server-Xwayland: Fix of 3 CVEs
CVE-2024-21886: fix heap overflow caused by incorrect DisableDevice recursion - CVE-2024-31083: fix use-after-free caused by incorrect glyph reuse handling - CVE-2023-5367: fix out-of-bounds write in property append/prepend handling...
CLSA-2025-1762537123 cups: Fix of CVE-2024-35235
CVE-2024-35235: patch arbitrary chmod vulnerability in cupsd process when starting server with symbolic link Listen configuration item...
CLSA-2025-1762244592 kernel: Fix of 5 CVEs
ext4: fix possible UAF when remounting r/o a mmp-protected file system CVE-2021-47342 - ext4: fix memory leak in ext4fillsuper - net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - ALSA: usb-audio: Fix an...
CLSA-2025-1762362716 freeglut: Fix of 2 CVEs
CVE-2024-24258: fix memory leak in glutAddSubMenu function - CVE-2024-24259: fix memory leak in glutAddMenuEntry function...
CLSA-2025-1761673460 qemu-kvm: Fix of CVE-2024-7409
CVE-2024-7409: fix improper synchronization during socket closure to prevent DoS attack...
CLSA-2025-1760722427 Fix CVE(s): CVE-2023-44487
SECURITY UPDATE: The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly - debian/patches/CVE-2023-44487.patch: HTTP/2 - per-iteration stream handling limit. - CVE-2023-44487...
CLSA-2025-1760712981 Fix CVE(s): CVE-2025-24813
SECURITY UPDATE: path Equivalence leads to Remote Code Execution and/or Information disclosure - debian/patches/CVE-2025-24813.patch: Enhance lifecycle of temporary files used by partial PUT - CVE-2025-24813...
CLSA-2025-1760649038 Update of alt-php
Bump ABI 4.15.0-252...