2022 matches found
MGASA-2026-0190 Updated golang-x-net packages fix security vulnerability
CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
MGASA-2026-0188 Updated jq packages fix security vulnerabilities
An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. CVE-2024-23337 It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of...
MGASA-2026-0182 Updated ruby-net-ssh packages fix security vulnerabilities
This update fixes CVE-2023-48795: Prefix Truncation Attacks in SSH Specification Terrapin Attack , for ruby-net-ssh...
MGASA-2026-0180 Updated packagekit packages fix security vulnerability
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root. CVE-2026-41651...
MGASA-2026-0177 Updated kernel-linus packages fix security vulnerabilities
Vanilla upstream kernel version 6.6.141 fixes vulnerabilities. For information about the vulnerabilities see the links...
MGASA-2026-0172 Updated lxc packages fix security vulnerability
CVE-2026-39402, lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion...
MGASA-2026-0169 Updated sdl2_sound packages fix security vulnerability
Updated packages fix CVE-2025-14369 in bundled drflac...
MGASA-2026-0166 Updated perl-Template-Toolkit packages fix security vulnerability
Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. CVE-2026-5090...
MGASA-2026-0159 Updated nginx package fixes a security vulnerability
The updated package fixes a security vulnerability: NGINX ngxhttprewritemodule vulnerability. CVE-2026-9256...
MGASA-2026-0161 Updated microcode package fixes security vulnerability
The updated package fixes a security vulnerability: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing microcode updates to mitigate this potential vulnerability. CVE-2025-35979...
MGASA-2026-0163 Updated bind packages fix security vulnerabilities
Updated bind package fixes security vulnerabilities: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 Amplification vulnerabilities via self-pointed glue records CVE-2026-3592 Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation CVE-2026-3593...
MGASA-2026-0149 Updated perl-WWW-Mechanize-Cached, perl-File-XDG & perl-Path-Tiny packages fix security vulnerabilities
WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution...
MGASA-2026-0148 Updated perl-YAML-Syck package fixes security vulnerability
YAML::Syck versions before 1.38 for Perl have an out-of-bounds read...
MGASA-2026-0145 Updated firefox & thunderbird packages fix security vulnerabilities
LZ4 compression library issue. CVE-2025-62813 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. CVE-2026-32776 libexpat before 2.7.5 allows an infinite loop while parsing DTD content. CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...
MGASA-2026-0144 Updated dpkg packages fix security vulnerabilities
It was discovered that dpkg-deb a component of dpkg, the Debian package management system does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service infinite loop spinning the CPU...
MGASA-2026-0138 Updated awstats packages fix security vulnerability
AWStats is vulnerable to Command Injection via the open function. CVE-2025-63261...
MGASA-2026-0131 Updated kernel-linus packages fix security vulnerability
Vanilla upstream kernel version 6.6.138 fixes vulnerability. For information about the vulnerability see the links...
MGASA-2026-0129 Updated apache packages fix security vulnerabilities
http2: double free and possible RCE on early reset. CVE-2026-23918 modrewrite elevation of privileges via apexpr. CVE-2026-24072 buffer overflow in modproxyajp via ajpmsgcheckheader. CVE-2026-28780 modmd unrestricted OCSP response. CVE-2026-29168 moddavlock indirect lock crash. CVE-2026-29169...
MGASA-2026-0126 Updated openvpn packages fix security vulnerabilities
CVE-2026-35058 - fix server ASSERT on receiving a suitably malformed packet with a valid tls-crypt-v2 key CVE-2026-40215 - fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances...
MGASA-2026-0124 Updated rootcerts, nss & firefox packages fix security vulnerabilities
Use-after-free in the DOM: Core & HTML component. CVE-2026-6746 Use-after-free in the WebRTC component. CVE-2026-6747 Uninitialized memory in the Audio/Video: Web Codecs component. CVE-2026-6748 Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. CVE-2026-6749...
MGASA-2026-0116 Updated opam packages fix security vulnerability
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVE-2026-41082...
MGASA-2026-0122 Updated krb5-appl packages fix security vulnerability
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC Set Local Characters suboption handler because addslc does not check whether the buffer is full. CVE-2026-32746...
MGASA-2026-0113 Updated tcpflow packages fix security vulnerability
tcpflow has TIM Element OOB Write in wifipcap. CVE-2026-25061...
MGASA-2026-0121 Updated nano packages fix security vulnerabilities
Local attacker can inject malicious .desktop launcher due to insecure directory permissions. CVE-2026-6842 Format string vulnerability leads to denial of service. CVE-2026-6843...
MGASA-2026-0119 Updated perl-Starman packages fix security vulnerability
Starman versions before 0.4018 for Perl allow HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An...
MGASA-2026-0109 Updated virtualbox packages fix security vulnerabilities
Some security vulnerabilities are fixed by this update; please see the links. If you will not update to kernel 6.6.137 flavors, please think in use dkms-virtualbox package instead of virtualbox-kernel as those packages have not been updated for previous kernels...
MGASA-2026-0108 Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities
Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel...
MGASA-2026-0105 Updated libtiff packages fix security vulnerabilities
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tifopen.c. CVE-2025-61143 libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. CVE-2025-61144...
MGASA-2026-0103 Updated giflib packages fix security vulnerability
Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. CVE-2026-23868...
MGASA-2026-0104 Updated python-cairosvg packages fix security vulnerability
CairoSVG vulnerable to Exponential DoS via recursive element amplification. CVE-2026-31899...
MGASA-2026-0102 Updated gdk-pixbuf2.0 packages fix security vulnerability
Denial of service via heap-based buffer overflow when processing a specially crafted jpeg image. CVE-2026-5201...
MGASA-2026-0093 Updated python-django packages fix security vulnerabilities
ASGI header spoofing via underscore/hyphen conflation. CVE-2026-3902 Privilege abuse in GenericInlineModelAdmin. CVE-2026-4277 Privilege abuse in ModelAdmin.listeditable. CVE-2026-4292 Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload. CVE-2026-33033...
MGASA-2026-0085 Updated polkit-122 packages fix security vulnerability
Denial of service via unbounded input processing through standard input. CVE-2026-4897...
MGASA-2026-0087 Updated python-pyasn1 packages fix security vulnerability
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion. CVE-2026-30922...
MGASA-2026-0078 Updated freeipmi packages fix security vulnerability
ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. CVE-2026-33554...
MGASA-2026-0079 Updated python-ply packages fix security vulnerability
Unsafe pickle file handling in Ply. CVE-2025-56005...
MGASA-2026-0073 Updated python-ujson packages fix security vulnerabilities
CVE-2026-32874 ujson 5.4.0 to 5.11.0 inclusive contains an accumulating memory leak in JSON parsing large outside of the range -2^63, 2^64 - 1 integers. ujson 5.4.0 to 5.11.0 has an integer overflow while handling a large indent which leads to a buffer overflow or infinite loop...
MGASA-2026-0071 Updated nodejs packages fix security vulnerabilities
Incomplete fix for CVE-2026-21637: loadSNI in tlswrap.js lacks try/catch leading to Remote DoS. CVE-2026-21637 Denial of Service via proto header name in req.headersDistinct Uncaught TypeError crashes Node.js process. CVE-2026-21710 Timing side-channel in HMAC verification via memcmp in...
MGASA-2026-0063 Updated perl-XML-Parser packages fix security vulnerabilities
XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size causing a heap corruption double free or corruption and crashes. CVE-2006-10002 XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in stserialstack. CVE-2006-10003...
MGASA-2026-0062 Updated vim packages fix security vulnerabilities
Command injection via newline in glob affects Vim 9.2.0202. CVE-2026-33412...
MGASA-2026-0059 Updated openssh packages fix security vulnerabilities
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. CVE-2025-61984...
MGASA-2026-0057 Updated python-nltk packages fix security vulnerability
Path Traversal in nltk/nltk. CVE-2026-0847...
MGASA-2026-0056 Updated tomcat packages fix security vulnerabilities
Client certificate verification bypass due to virtual host mapping. CVE-2025-66614 Security constraint bypass with HTTP/0.9. CVE-2026-24733 OCSP revocation bypass. CVE-2026-24734...
MGASA-2026-0055 Updated vim packages fix security vulnerability
NFA regex engine NULL pointer dereference affects Vim 9.2.0137. CVE-2026-32249...
MGASA-2026-0053 Updated thunderbird packages fix security vulnerabilities
Incorrect boundary conditions in the WebRTC: Audio/Video component. CVE-2026-2757 Use-after-free in the JavaScript: GC component. CVE-2026-2758 Incorrect boundary conditions in the Graphics: ImageLib component. CVE-2026-2759 Sandbox escape due to incorrect boundary conditions in the Graphics:...
MGASA-2026-0051 Updated coturn packages fix security vulnerability
IPv4-mapped IPv6 ::ffff:0:0/96 bypasses denied-peer-ip ACL. CVE-2026-27624...
MGASA-2026-0048 Updated rsync packages fix security vulnerability
Out of bounds array access via negative index. CVE-2025-10158...
MGASA-2026-0047 Updated gegl packages fix security vulnerabilities
ZDI-CAN-28618: New Vulnerability Report at rgbe.c. CVE-2026-2049 ZDI-CAN-28266: New Vulnerability Report at rgbe.c. CVE-2026-2050...