CLSA-2024-1713791454 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2021-46925 - net/smc: get rid of txpend waits in socket closing - net/smc: fix kernel panic caused by race of smcsock CVE-url: https://ubuntu.com/security/CVE-2024-23307 - md/raid5: fix atomicity violation in raid5cachecount CVE-url:...

CLSA-2024-1712263970 kernel: Fix of 48 CVEs

bpf: Fix re-attachment branch in bpftracingprogattach CVE-2024-26591 - ext4: improve error recovery code paths in ext4remount CVE-2024-0775 - smb: client: fix OOB in receiveencryptedstandard CVE-2024-0565 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-2023-52449 - net:...

CLSA-2024-1705081601 Fix of 7 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-7192 - netfilter: ctnetlink: fix possible refcount leak in ctnetlinkcreateconntrack CVE-url: https://ubuntu.com/security/CVE-2023-6610 - smb: client: fix potential OOB in smb2dumpdetail CVE-url: https://ubuntu.com/security/CVE-2023-6606 - smb: client:...

CLSA-2023-1701963303 kernel: Fix of 18 CVEs

net/tls: do not free tlsrec on async operation in bpfexectxverdict CVE-2023-6176 - wifi: mac80211: fix MBSSID parsing use-after-free CVE-2022-42719 - mac80211: always allocate struct ieee80211elems CVE-2022-42719 - x86/sev: Check for user-space IOIO pointing to kernel space CVE-2023-46813 -...

CLSA-2023-1689258488 Fix CVE(s): CVE-2023-28486, CVE-2023-2848, CVE-2023-28487

SECURITY UPDATE: control characters are not escaped - debian/patches/CVE-2023-2848x.patch: escape control chars - CVE-2023-28486 - CVE-2023-28487...

CLSA-2023-1677095961 git: Fix of 6 CVEs

CVE-2022-41903: fix out-of-bounds write caused by integer overflow - CVE-2021-40330: forbid newlines in host and path - CVE-2022-39260: reject too long command line strings - CVE-2021-23521: implement size checks for .gitattributes - CVE-2023-22490: prevent arbitrary path exfiltration when using...

CLSA-2023-1676571183 Update of nss

Update to CKBI 2.60 from NSS 3.86 - Added: - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - Certificate "Certainly Root E1" - Certificate "Certainly Root R1" - Certificate "DigiCert SMIME ECC P384 Root G5" - Certificate "DigiCert SMIME RSA4096 Root G5" - Certificate...

CLSA-2022-1671126165 curl: Fix of CVE-2022-32221

CVE-2022-32221: fix issue when POST following PUT confusion...

CLSA-2026-1790202437 TuxCare security update for nodemailer (4 CVEs)

TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 2.7.2-tuxcare.6...

CLSA-2026-1788800921 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 5.3.29-tuxcare.10...

CLSA-2026-1773101685 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post5+tuxcare...

CLSA-2026-1779096552 Fix CVE(s): CVE-2025-13836, CVE-2026-4519

SECURITY UPDATE: memory denial of service via attacker-controlled Content-Length in http.client - debian/patches/CVE-2025-13836.patch: rewrite Lib/http/client.py saferead to read large responses in geometrically-growing chunks bounded by MINREADBUFSIZE 1 MiB, preventing OOM when a malicious serve...

CLSA-2026-1778928586 libpng: Fix of CVE-2026-34757

CVE-2026-34757: use-after-free in pngsetPLTE, pngsettRNS, pngsethIST, pngsettext, pngsetsPLT and pngsetunknownchunks when the caller passes the pointer returned by the corresponding getter back to the setter...

CLSA-2026-1778858907 mod_proxy_cluster: Fix of 2 CVEs

CVE-2023-6710: stored XSS in modcluster-manager HTML output via virtual host and context names rendered without HTML escaping - CVE-2024-10306: unauthorized MCMP requests due to directive being ignored for protocol-handler filtering; runtime guard now refuses siblings of EnableMCPMReceive, and...

CLSA-2026-1778787063 kernel: Fix of 122 CVEs

net: skbuff: propagate shared-frag marker through pskbcopy - mptcp: always handle address removal under msk socket lock CVE-2025-21875 - uprobes: Reject the shared zeropage in uprobewriteopcode CVE-2025-21881 - net: hns3: make sure ptp clock is unregister and freed if hclgeptpgetcycle returns an...

CLSA-2026-1778489316 java-1.8.0-openjdk: Fix of 8 CVEs

Update to shenandoah-jdk8u492-b09 - Security fixes from OpenJDK 8u492-b09: - CVE-2026-22003: enhance behavior of some intrinsics - CVE-2026-22007: enhance crypto algorithm support - CVE-2026-22013: improve Kerberos credentialing - CVE-2026-22018: enhance Zip file reading - CVE-2026-22021: enhance...

CLSA-2026-1778218633 jasper: Fix of 3 CVEs

Add Amazon Linux 2 ELS support mirrors centos7els branch with .amzn2 dist via / leapfrog over stock 1.900.1-33.amzn2.0.1 - Import CVE-2020-27828 patch from amzn2 stock SRPM out-of-bounds write in jpc encoder; jasper-2.0.14-CVE-2020-27828.patch - Import CVE-2021-3443 patch from amzn2 stock SRPM...

CLSA-2026-1778143159 jq: Fix of 2 CVEs

CVE-2026-33948: fix NUL truncation in JSON parser validation bypass - CVE-2026-33947: fix unbounded recursion stack overflow in jvsetpath/getpath/delpaths...

CLSA-2026-1778068515 Fix CVE(s): CVE-2026-0966

SECURITY UPDATE: heap buffer underflow in sshgethexa on zero-length or NULL input, remotely reachable via GSSAPI authentication logging - debian/patches/CVE-2026-0966.patch: reject NULL/zero-length input in sshgethexa in src/dh.c - CVE-2026-0966: fix heap buffer underflow in sshgethexa...

CLSA-2026-1778005827 git: Fix of CVE-2025-46835

CVE-2025-46835: fix Git GUI from creating and overwriting arbitrary files when editing a file in a maliciously crafted repository directory...

CLSA-2026-1777683582 mysql: Fix of CVE-2018-2755

CVE-2018-2755: harden binlog event decoding against corrupt binary log files BUG24365972...

CLSA-2026-1777323039 vim: Fix of 3 CVEs

CVE-2021-4173: fix double free in Vim9 nested :def function definition - CVE-2022-3352: fix use-after-free when SpellFileMissing autocmd deletes the current buffer during spell file loading - CVE-2022-2343: fix heap buffer overflow in inscompladdinfercase when completing a long line with...

CLSA-2026-1777306907 runc: Fix of CVE-2026-25679

Rebuild with Go 1.25.8 to fix Go standard library CVE - CVE-2026-25679: reject invalid IPv6 host literals in net/url.Parse to prevent URL validation bypass...

CLSA-2026-1776791510 nginx: Fix of 5 CVEs

CVE-2017-7529: fix integer overflow in range filter - CVE-2018-16843: fix excessive memory consumption in HTTP/2 - CVE-2018-16844: fix excessive CPU usage in HTTP/2 - CVE-2019-9511: fix excessive memory growth via HTTP/2 DATA frame manipulation - CVE-2019-9513: fix excessive CPU usage via HTTP/2...

CLSA-2026-1775655363 kernel: Fix of 9 CVEs

ovl: Filter invalid inodes with missing lookup function CVE-2024-56570 - ALSA: aloop: Fix racy access at PCM trigger CVE-2026-23191 - media: imon: reorganize serialization CVE-2025-39993 - usb: xhci: Fix inverted ringxrunevent check in handletxevent CVE-2025-37882 - Revert "VFS: Impose ordering...

CLSA-2026-1772039226 golang: Fix of 2 CVEs

CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing - CVE-2025-61732: prevent cgo code smuggling by removing user-controlled content from documentation strings in generated ASTs...

CLSA-2026-1771664593 Fix CVE(s): CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

OpenJDK 8u482 release + CVE-2026-21945: enhance Certificate Checking + CVE-2026-21932: enhance Handling of URIs + CVE-2026-21933: improve HttpServer Request handling + CVE-2026-21925: improve JMX connections - Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html...

CLSA-2026-1771408532 java-21-openjdk: Fix of 3 CVEs

Update to jdk-21.0.10+7 - CVE-2026-21945: fix possible DOS - CVE-2025-65018: fix libpng heap buffer overflow in pngimagefinishread when processing 16-bit interlaced PNGs with 8-bit output format - CVE-2025-64720: fix libpng out-of-bounds read in pngimagereadcomposite when processing palette...

CLSA-2026-1768825166 kernel: Fix of 7 CVEs

fs/proc: fix uaf in procreaddirde CVE-2025-40271 - fs: fix UAF/GPF bug in nilfsmdtdestroy CVE-2022-2978 - Bluetooth: L2CAP: fix "bad unlock balance" in l2capdisconnectrsp CVE-2023-53297 - net: sched: sfb: fix null pointer access issue when sfbinit fails CVE-2022-50356 - ALSA: usb-audio: Fix size...

CLSA-2026-1768663754 kernel: Fix of 38 CVEs

ALSA: usb-audio: Fix out-of-bounds read in sndusbgetaudioformatuac3 CVE-2025-38249 - drm/i915/gt: Fix timeline left held on VMA alloc error CVE-2025-38389 - md/raid1: Fix stack memory use after return in raid1reshape CVE-2025-38445 - atm: clip: Fix infinite recursive call of clippush...

CLSA-2026-1768310750 git: Fix of CVE-2024-50349

CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively...

CLSA-2025-1764151168 kernel: Fix of 39 CVEs

perf/aux: Fix AUX buffer serialization CVE-2024-46713 - block: fix uaf for flush rq while iterating tags CVE-2024-53170 - zram: fix potential UAF of zram table CVE-2025-21671 - sched: schcake: add bounds checks to host bulk flow fairness counts CVE-2025-21647 - bpf: Fix UAF via mismatching...

CLSA-2025-1758289815 Fix CVE(s): CVE-2025-53101

SECURITY UPDATE: stack overflow via multiple consecutive %d format specifiers in filename template - debian/patches/CVE-2025-53101.patch: Fix InterpretImageFilename function by adjusting the offset to prevent potential buffer overflow - CVE-2025-53101...

CLSA-2025-1755007642 java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08. That fixes following CVEs: - CVE-2025-30749: better Glyph drawing - CVE-2025-30754: enhance TLS protocol support - CVE-2025-30761: improve scripting supports - CVE-2025-50106: glyph out-of-memory access and crash...

CLSA-2025-1751038683 Update of tzdata

Upgrade to tzdata-2025b - New zone for Aysén Region in Chile which moves from -04/-03 to -03. - Paraguay adopted permanent -03 starting spring 2024. - Improve pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Improve historical data for Mexico, Mongolia, and Portugal. - System V...

CLSA-2025-1748282295 Fix of 34 CVEs

SECURITY UPDATE: Misc vulnerability fixes - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305...

CLSA-2025-1748001706 gstreamer1-plugins-good: Fix of CVE-2024-47774

CVE-2024-47774: fix an integer overflow in the AVI subtitle parser that can lead to out-of-bounds reads and can cause crashes for certain input files...

CLSA-2025-1746653856 ruby: Fix of 2 CVEs

upgrade rexml version to 3.3.3 - CVE-2024-41946: fix DoS vulnerability when parsing many entity expansions with SAX2 or pull parser API - CVE-2024-41123: fix DoS vulnerability when parsing XML with specific characters...

CLSA-2024-1716980150 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26929 - scsi: qla2xxx: Fix double free of fcport CVE-url: https://ubuntu.com/security/CVE-2024-35997 - HID: i2c-hid: remove I2CHIDREADPENDING flag to prevent lock-up CVE-url: https://ubuntu.com/security/CVE-2023-52752 - smb: client: fix use-after-free...

CLSA-2024-1714727824 expat: Fix of CVE-2023-52425

CVE-2023-52425: fix reparsings for large token to prevent DoS...

CLSA-2024-1708171036 Fix of 10 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-23851 - dm: limit the number of targets and parameter size area CVE-url: https://ubuntu.com/security/CVE-2024-23849 - net/rds: Fix UBSAN: array-index-out-of-bounds in rdscmsgrecv CVE-url: https://ubuntu.com/security/CVE-2024-1086 - netfilter: nftables...

CLSA-2023-1695041288 Fix of 8 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-4622 - afunix: Fix null-ptr-deref in unixstreamsendpage. Jammy update: v5.15.105 upstream stable release LP: 2023230 // CVE-url: https://ubuntu.com/security/CVE-2022-4269 - net/sched: actmirred: better wording on protection against excessive stack...

CLSA-2022-1669237532 python3: Fix of CVE-2022-45061

CVE-2022-45061: Fix quadratic time idna decoding...

CLSA-2022-1646060698 Fix of CVE: CVE-2021-31807, CVE-2021-28662, CVE-2021-33620, CVE-2021-28652, CVE-2021-28651, CVE-2021-31808, CVE-2021-31806

CVE-2021-28651: Fix memory leak that perform DoS via buffer-management bug - CVE-2021-28652: Fix cache manager URL parsing that perform DoS via incorrect parser validation - CVE-2021-28662: Add limit HeaderLookupTablet::lookup to BadHdr and specific IDs that perform DoS via certain response...

CLSA-2026-1790489187 TuxCare security update for @angular (5 CVEs)

TuxCare rebuilt 16 @angular packages to address 5 CVEs. Fixed in 19.2.23-tuxcare.5...

CLSA-2026-1786520698 TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.3.4-tuxcare.1...

CLSA-2026-1786359305 TuxCare security update for swagger-ui (3 CVEs)

TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.2...

CLSA-2026-1779238049 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.7.3-tuxcare.1...

CLSA-2026-1779203719 php: Fix of 6 CVEs

CVE-2026-6722: fix stale SOAPGLOBAL refmap pointer with Apache Map GHSA-85c2-q967-79q5 - CVE-2026-7262: fix broken Apache map value NULL check in soap encoder GHSA-hmxp-6pc4-f3vv - CVE-2026-7568: fix signed integer overflow of char array offset in metaphone GHSA-96wq-48vp-hh57 - CVE-2026-7261:...

CLSA-2026-1779123410 jq: Fix of 8 CVEs

CVE-2026-40164: randomize hash seed to mitigate hash collision DoS - CVE-2026-40612: limit containment check depth - CVE-2026-41256: fix NUL truncation in program files loaded with -f - CVE-2026-41257: fix signed-int overflow in stackreallocate - CVE-2026-43894: cap numeric literal length to...