CLSA-2026-1775649722 libxml2: Fix of 6 CVEs

CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint - CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries - CVE-2026-0989: add RelaxNG include recursion limit - CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI -...

CLSA-2026-1775148022 binutils: Fix of 3 CVEs

CVE-2025-66862: fix heap-buffer-overflow in gnuspecial in cplus-dem.c - CVE-2025-66863: fix SEGV in ddiscriminator in cp-demangle.c - CVE-2025-66865: fix stack overflow in dprintcomp in cp-demangle.c...

CLSA-2026-1775058454 python: Fix of CVE-2025-15366

CVE-2025-15366: reject control characters in IMAP commands to prevent command injection...

CLSA-2026-1775040432 golang: Fix of CVE-2025-61731

CVE-2025-61731: fix pkg-config --log-file argument injection via cgo pkg-config directive...

CLSA-2026-1774605210 expat: Fix of 2 CVEs

CVE-2026-32777: fix infinite loop while parsing DTD content - CVE-2026-32778: fix NULL pointer dereference in setContext on retry after OOM...

CLSA-2026-1774460378 postgresql11: Fix of 4 CVEs

Fix CVE-2025-1094: Improper neutralization of quoting syntax in libpq escape functions allowing SQL injection. - Fix CVE-2024-7348: TOCTOU race condition in pgdump allows arbitrary SQL function execution via view/foreign table replacement. - Fix CVE-2024-10979: Block environment variable...

CLSA-2026-1773930007 Fix CVE(s): CVE-2026-3731

SECURITY UPDATE: out-of-bounds read from manipulated SFTP extension index - debian/patches/CVE-2026-3731.patch: Fix out-of-bound read in sftp extensions by replacing '' with '=' in index checks; cause: off-by-one error in index comparison allowing idx equal count. - CVE-2026-3731...

CLSA-2026-1773784132 Update of alt-php

Port to Debian 10 buster with renamed libraries to avoid conflicts with system PostgreSQL packages. Rename library packages to allow coexistence with other PostgreSQL versions: - libpq5 - libpq5-9.6 library: libpq-9.6.so.5 - libpq-dev - libpq-dev-9.6 - libecpg6 - libecpg6-9.6 library:...

CLSA-2026-1773224214 nfs-utils: Fix of CVE-2025-12801

CVE-2025-12801: fix rpc.mountd privilege escalation allowing NFSv3 clients to bypass rootsquash and allsquash when mounting subdirectories...

CLSA-2026-1773046740 kernel: Fix of 21 CVEs

i40e: fix IRQ freeing in i40evsirequestirqmsix error path CVE-2025-39911 - media: rc: fix races with imondisconnect CVE-2025-39993 - VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify CVE-2025-38102 - partitions: mac: fix handling of bogus partition table CVE-2025-21772 - tracing:...

CLSA-2026-1769018042 Fix CVE(s): CVE-2025-68973

SECURITY UPDATE: memory corruption in armor parser - debian/patches/CVE-2025-68973.patch: Fix faulty double increment in armorfilter function. - CVE-2025-68973...

CLSA-2026-1772622084 libtiff: Fix of CVE-2025-61144

CVE-2025-61144: add MAXSAMPLES bounds check in combineSeparateSamplesBytes to prevent stack-based buffer overflow when spp exceeds MAXSAMPLES in tiffcrop...

CLSA-2026-1772575082 libtiff: Fix of CVE-2025-61144

CVE-2025-61144: fix stack-based buffer overflow occurs in tiffcrop...

CLSA-2026-1772464786 grafana: Fix of CVE-2025-68121

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE's - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry...

CLSA-2026-1771855171 glib2: Fix of CVE-2025-14087

CVE-2025-14087: fix integer overflow in GVariant parser leading to heap corruption via buffer underflow when processing malicious input strings...

CLSA-2026-1772146691 libpng: Fix of CVE-2026-25646

CVE-2026-25646: fix a heap buffer overflow in pngsetquantize...

CLSA-2026-1772113038 Fix of 12 CVEs

OpenJDK 8u482 release, build 8. Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html - Security fixes 8u482: + CVE-2026-21945: Prevent DoS via repeated crash or hang in sandbox security + CVE-2026-21932: Fix integrity issue in sandboxed handling of untrusted input ...

CLSA-2026-1772098033 python2: Fix of CVE-2025-15367

CVE-2025-15367: reject control characters in POP3 commands to prevent command injection via embedded newlines...

CLSA-2026-1771925958 python2: Fix of 2 CVEs

CVE-2026-1299: reject email header values containing newlines without whitespace to prevent header injection and info leak via the buffer protocol - CVE-2024-6923: ensure email headers are encoded and verified correctly, raising exceptions for malformed input to prevent processing of invalid or...

CLSA-2026-1771663697 curl: Fix of 2 CVEs

CVE-2025-14524: fix OAuth2 bearer token leak on cross-protocol redirect - CVE-2025-15224: fix libssh public-key auth fallback to SSH agent...

CLSA-2026-1771601553 Fix CVE(s): CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

OpenJDK 8u482 release + CVE-2026-21945: enhance Certificate Checking + CVE-2026-21932: enhance Handling of URIs + CVE-2026-21933: improve HttpServer Request handling + CVE-2026-21925: improve JMX connections - Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html...

CLSA-2026-1771414778 Update of linux-firmware

Addition AMD CPU microcode for processor family 0x1a: cpuid:0x00B00F21ver:0x0B002161, cpuid:0x00B00F81ver:0x0B008121, cpuid:0x00B10F10ver:0x0B101058, cpuid:0x00B20F40ver:0x0B204037, cpuid:0x00B40F40ver:0x0B404035, cpuid:0x00B40F41ver:0x0B404108, cpuid:0x00B60F00ver:0x0B600037,...

CLSA-2026-1770310846 java-1.8.0-openjdk: Fix of 3 CVEs

Upgrade to shenandoah-jdk8u482-b08 GA fixing the following CVE: - CVE-2026-21945: enhance certificate checking - CVE-2026-21925: improve JMX connections - CVE-2026-21933: improve HttpServer request handling...

CLSA-2026-1771112524 Update of alt-php

Update ca-certificates database to 20260129: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.82. - The following certificates were updated: Certificate "GlobalSign Root CA" Certificate "Entrust.net Premium 2048 Secure Server CA" Certificate "Comodo AAA...

CLSA-2026-1770216604 Update of alt-php

New microcode update packages from upstream up to 2025-11-11: - New microcodes: sig 0x000a06e1, pfmask 0x97, 2025-06-27, rev 0x1000273, size 1635328 - Updated microcodes: sig 0x000606a6, pfmask 0x87, 2025-03-11, rev 0xd000410, size 309248 sig 0x000606c1, pfmask 0x10, 2025-03-06, rev 0x10002e0, si...

CLSA-2026-1770119166 java-1.8.0-openjdk: Fix of CVE-2026-21945

Update to openjdk-shenandoah-jdk8u-shenandoah-jdk8u482-b03. - CVE-2026-21945: Security component vulnerability allowing unauthenticated attacker with network access to cause hang or crash DoS...

CLSA-2026-1769701085 pki-servlet-engine: Fix of CVE-2025-31651

CVE-2025-31651: fix improper neutralization of escape, meta or control sequences to avoid bypassing rewrite rules...

CLSA-2026-1769686676 php: Fix of 2 CVEs

CVE-2025-1220: add null byte validation and fix hostname formatting to prevent null byte truncation that could bypass hostname access checks - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP Extension via Large XML namespace prefix...

CLSA-2026-1768909961 libpng: Fix of CVE-2025-64720

CVE-2025-64720: fix buffer overflow in pnginitreadtransformations function during palette compositing with optimized alpha...

CLSA-2026-1768815869 buildah: Fix of CVE-2025-47913

CVE-2025-47913: prevent ssh-agent panic by rejecting unexpected message types and returning a descriptive error instead...

CLSA-2026-1768412660 python3.11: Fix of CVE-2025-13836

CVE-2025-13836: fixed memory exhaustion vulnerability when reading HTTP responses with malicious Content-Length headers...

CLSA-2026-1768392809 git: Fix of CVE-2024-32021

CVE-2024-32021: fix symlink vulnerability allowing creation of hardlinks to arbitrary files in local source repository cloning...

CLSA-2026-1768300368 Fix CVE(s): CVE-2025-58436

SECURITY UPDATE: fix DoS by a client that connect to cupsd sends slow messages. - debian/patches/CVE-2025-58436.patch: fix unresponsive cupsd process caused by a slow client. - CVE-2025-58436. Fix test/run-stp-tests.sh - debian/patches/waiting-limit.patch: limit the waiting for a server dunring...

CLSA-2026-1768213076 httpd: Fix of 2 CVEs

CVE-2025-65082: fix CGI environment variable injection by preventing HTTP headers from overriding server-set variables - CVE-2025-66200: prevent suexec bypass by removing request notes usage and rejecting the undocumented RequestHeader note option...

CLSA-2025-1765214354 Update of java-1.8.0-openjdk

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u472-b08 GA...

CLSA-2025-1764152728 osbuild-composer: Fix of CVE-2025-27144

CVE-2025-27144: fix memory exhaustion vulnerability when parsing compact JWS or JWE input by updating the code to split JWT tokens...

CLSA-2025-1764321881 perl-FCGI: Fix of CVE-2025-40907

CVE-2025-40907: fix integer overflow and heap-based buffer overflow in fcgi2 library...

CLSA-2025-1764026530 qt5-qtbase: Fix of CVE-2023-38197

CVE-2023-38197: fix infinite loops in recursive entity expansion...

CLSA-2025-1763418416 gnutls: Fix of CVE-2024-12243

CVE-2024-12243: fix inefficient algorithm in libtasn1 for decoding certain DER-encoded certificate data to prevent denial-of-service condition...

CLSA-2025-1761139764 kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...

CLSA-2025-1760556795 openssl: Fix of CVE-2018-0734

CVE-2018-0734: fix timing side channel attack in DSA signature algorithm...

CLSA-2025-1760542306 glibc: Fix of CVE-2025-0395

CVE-2025-0395: fix buffer underallocation in assert and libcfatal mmap handling...

CLSA-2025-1759248934 python3: Fix of CVE-2025-8194

CVE-2025-8194: tarfile: validate archives to ensure non-negative member offsets...

CLSA-2025-1758916535 Fix CVE(s): CVE-2025-58060

SECURITY UPDATE: authentication bypass vulnerability - debian/patches/CVE-2025-58060.patch: block authentication using alternate method in scheduler/auth.c - CVE-2025-58060...

CLSA-2025-1758041082 libsndfile: Fix of CVE-2024-50612

CVE-2024-50612: fix out-of-bounds read in vorbisanalysiswrote in oggvorbis.c...

CLSA-2025-1758020272 Update of alt-php

Bump ABI 5.4.0-221...

CLSA-2025-1757662580 Update of microcode_ctl

Update Intel CPU microcode to 20250812: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000401; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000643; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

CLSA-2025-1755708215 kernel: Fix of 2 CVEs

can: bcm: Fix UAF in bcmprocshow CVE-2023-52922 - udmabuf: fix a buf size overflow issue during udmabuf creation CVE-2025-37803...

CLSA-2025-1755516017 tomcat6: Fix of CVE-2025-24813

CVE-2025-24813: enhance lifecycle of temporary files used by partial PUT...

CLSA-2025-1753966983 java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 GA. That fixes following CVEs: - CVE-2025-30749: better Glyph drawing - CVE-2025-30754: enhance TLS protocol support - CVE-2025-30761: improve scripting supports - CVE-2025-50106: glyph out-of-memory access and crash...