1747 matches found
MGASA-2026-0342 Updated flatpak package fixes security vulnerabilities
Updated flatpak package fixes security vulnerabilities. Please see the links for additional information...
MGASA-2026-0338 Updated avahi packages fix security vulnerabilities
Simple protocol server ignores accepts unlimited connections and logs failures without limit. CVE-2025-59529 Avahi has Uncontrolled Recursion in lookuphandlecname function. CVE-2026-24401 Reachable assertion in transportflagsfromdomain via conflicting publish flags crashes avahi-daemon...
MGASA-2026-0337 Updated kernel-linus packages fix security vulnerabilities
Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links...
MGASA-2026-0332 Updated roundcubemail package fixes security vulnerabilities
Updated roundcubemail to the 1.6.17 version to fix security vulnerabilities: Some XSS and DoS errors have been corrected. Various vulnerabilities in the password plugin have been fixed. An infinite loop has been fixed...
MGASA-2026-0330 Updated php8.5 packages fix security vulnerabilities
Updated php 8.5 packages fix some security vulnerabilities. For details see the references...
MGASA-2026-0327 Updated python-starlette package fixes security vulnerabilities
The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...
MGASA-2026-0320 Updated perl-Unicode-LineBreak package fixes a security vulnerability
The updated package fixes a security vulnerability: Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. CVE-2026-8594...
MGASA-2026-0318 Updated perl-GD package fixes a security vulnerability
The updated package fixes a security vulnerability: GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle. CVE-2026-11526...
MGASA-2026-0296 Updated yelp packages fix a security vulnerability
The updated packages fix a security vulnerability: Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications. CVE-2026-13601...
MGASA-2026-0290 Updated socat package fixes a security vulnerability
The updated package fixes a security vulnerability: Heap Buffer Overflow via SOCKS5 Reply Parser. CVE-2026-56123...
MGASA-2026-0287 Updated tig package fixes a security vulnerability
The updated package fixes a security vulnerability: editor command injection vulnerability...
MGASA-2026-0277 Updated xmlstarlet package fixes a security vulnerability
The updated package fixes a security vulnerability: XML external entity vulnerability. References: https://lists.fedoraproject.org/archives/list/[email protected] oraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/...
MGASA-2026-0274 Updated php packages fix a security vulnerability
The updated php packages fix a security issue: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD. CVE-2026-14355...
MGASA-2026-0276 Updated golang packages fix security vulnerabilities
The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...
MGASA-2026-0267 Updated perl-CSS-Minifier-XS package fixes a security vulnerability
The updated package fixes a security vulnerability: CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. CVE-2026-13593...
MGASA-2026-0272 Updated perl-String-Util package fixes a security vulnerability
The updated package fixes a security vulnerability: String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. CVE-2026-14895...
MGASA-2026-0264 Updated perl-HTML-Parser packages fix security vulnerability
HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. CVE-2026-8829...
MGASA-2026-0252 Updated imagemagick packages fix security vulnerabilities
The updated packages fix numerous security vulnerabilities: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797. CVE-2026-25797 Heap Buffer Underwrite in Floyd-Steinberg depth dithering. CVE-2026-48724 Infinite Loop in subimage-search with crafted image. CVE-2026-48733 Stack...
MGASA-2026-0250 Updated haproxy packages fix security vulnerability
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record...
MGASA-2026-0248 Updated libxml2 packages fix a security vulnerability
The updated packages fix a security vulnerability: Denial of service via crafted xsd-validated document. CVE-2026-6732...
MGASA-2026-0244 Updated perl-List-SomeUtils-XS packages fix security vulnerability
List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. CVE-2026-12844...
MGASA-2026-0247 Updated libheif packages fix security vulnerabilities
libheif has a Heap OOB Read/SEGV Crash via Zero samplesperchunk. CVE-2026-32738 libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup. CVE-2026-32739 Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing. CVE-2026-32740 libheif has a heap buffer overflow in...
MGASA-2026-0242 Updated firefox, firefox-l10n, rootcerts, nss packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Privilege escalation in the Graphics: WebRender component. CVE-2026-12289 Memory safety bug fixed in Firefox ESR 140.12. CVE-2026-12290 Use-after-free in the Networking: HTTP component. CVE-2026-12291 Incorrect boundary conditions in the Web Audi...
MGASA-2026-0240 Updated vim packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Arbitrary Code Execution via Python Omni-Completion in Vim 9.1.1783 && Vim = 9.2.0320 && Vim 9.2.0679. CVE-2026-57454 Out-of-bounds Write in SOFO Soundfolding in Vim 9.2.0698. CVE-2026-57455 Arbitrary Code Execution via Python Omni-Completion...
MGASA-2026-0238 Updated 7zip packages fix a security vulnerability
7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation. CVE-2026-48095...
MGASA-2026-0235 Updated mariadb packages fix security vulnerabilities
This update to the latest LTS version fixes some severe security vulnerabilities...
MGASA-2026-0231 Updated opensc packages fix security vulnerabilities
These packages fix security vulnerabilities: CVE-2026-10275, A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is...
MGASA-2026-0230 Updated perl-Archive-Tar package fixes security vulnerabilities
The updated package fixes security vulnerabilities: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. CVE-2026-42496 Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the...
MGASA-2026-0228 Updated mumble packages fix security vulnerability
Mumble is prone to an out-of-bounds array access, which may result in denial of service client crash...
MGASA-2026-0221 Updated libcap packages fix security vulnerabilities
CVE-2026-4878. A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By...
MGASA-2026-0218 Updated log4cxx packages fix security vulnerability
CVE-2026-40023, Apache Log4cxx, Apache Log4cxx Conan, Apache Log4cxx Brew: Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters...
MGASA-2026-0203 Updated memcached packages fix security vulnerabilities
CVE-2026-47784 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslserveruserdbcheckpass. CVE-2026-47783 In memcached before 1.6.42, username data for SASL password database authentication has a timing side...
MGASA-2026-0204 Updated expat packages fix security vulnerabilities
CVE-2026-45186 the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input...
MGASA-2026-0201 Updated cups packages fix security vulnerabilities
CVE-2026-27447, Authorization bypass via case-insensitive group-member lookup. CVE-2026-39314, Integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported CVE-2026-39316, Use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer...
MGASA-2026-0193 Updated openssh packages fix security vulnerabilities
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode. CVE-2026-35385 In OpenSSH before 10.3, command execution can occur vi...
MGASA-2026-0190 Updated golang-x-net packages fix security vulnerability
CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
MGASA-2026-0188 Updated jq packages fix security vulnerabilities
An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. CVE-2024-23337 It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of...
MGASA-2026-0182 Updated ruby-net-ssh packages fix security vulnerabilities
This update fixes CVE-2023-48795: Prefix Truncation Attacks in SSH Specification Terrapin Attack , for ruby-net-ssh...
MGASA-2026-0180 Updated packagekit packages fix security vulnerability
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root. CVE-2026-41651...
MGASA-2026-0172 Updated lxc packages fix security vulnerability
CVE-2026-39402, lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion...
MGASA-2026-0169 Updated sdl2_sound packages fix security vulnerability
Updated packages fix CVE-2025-14369 in bundled drflac...
MGASA-2026-0166 Updated perl-Template-Toolkit packages fix security vulnerability
Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. CVE-2026-5090...
MGASA-2026-0159 Updated nginx package fixes a security vulnerability
The updated package fixes a security vulnerability: NGINX ngxhttprewritemodule vulnerability. CVE-2026-9256...
MGASA-2026-0163 Updated bind packages fix security vulnerabilities
Updated bind package fixes security vulnerabilities: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 Amplification vulnerabilities via self-pointed glue records CVE-2026-3592 Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation CVE-2026-3593...
MGASA-2026-0161 Updated microcode package fixes security vulnerability
The updated package fixes a security vulnerability: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing microcode updates to mitigate this potential vulnerability. CVE-2025-35979...
MGASA-2026-0149 Updated perl-WWW-Mechanize-Cached, perl-File-XDG & perl-Path-Tiny packages fix security vulnerabilities
WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution...
MGASA-2026-0148 Updated perl-YAML-Syck package fixes security vulnerability
YAML::Syck versions before 1.38 for Perl have an out-of-bounds read...
MGASA-2026-0145 Updated firefox & thunderbird packages fix security vulnerabilities
LZ4 compression library issue. CVE-2025-62813 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. CVE-2026-32776 libexpat before 2.7.5 allows an infinite loop while parsing DTD content. CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...
MGASA-2026-0144 Updated dpkg packages fix security vulnerabilities
It was discovered that dpkg-deb a component of dpkg, the Debian package management system does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service infinite loop spinning the CPU...