CLSA-2026-1771009339 Update of nss

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go...

CLSA-2026-1770648617 expat: Fix of CVE-2026-24515

CVE-2026-24515: make XMLExternalEntityParserCreate copy unknown encoding handler user data...

CLSA-2026-1770311244 gimp: Fix of 2 CVEs

CVE-2025-14425: fix JP2 image loader buffer overflow by validating pixel buffer size calculation to prevent potential remote code execution - CVE-2025-14422: fix parsing of PNM files to prevent integer overflow leading to remote code execution...

CLSA-2026-1770217418 Update of microcode_ctl

Update Intel CPU microcode to 20251111: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000410; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000650; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

CLSA-2026-1770116781 java-1.8.0-openjdk: Fix of 5 CVEs

CVE-2026-21945: security component vulnerability allowing unauthenticated attackers with network access to cause denial of service - CVE-2026-21933: networking component vulnerability allowing unauthenticated attackers with network access to compromise confidentiality and integrity -...

CLSA-2026-1769621572 python2: Fix of CVE-2025-12084

CVE-2025-12084: fix quadratic algorithm when building nested elements with xml.dom.minidom appendChild method...

CLSA-2026-1769506798 cups: Fix of CVE-2025-58436

CVE-2025-58436: fix issue where slow messages could delay cupsd...

CLSA-2026-1767800942 httpd: Fix of CVE-2025-58098

CVE-2025-58098: don't pass querry string args as command line arguments to SSI-invoked CGI scripts...

CLSA-2025-1766617167 kernel: Fix of 27 CVEs

xfrm: Duplicate SPI Handling CVE-2025-39965 - xfrm: state: use atomicincnotzero to increment refcount - padata: Fix pd UAF once and for all CVE-2025-38584 - padata: Remove broken queue flushing CVE-2023-52854 - padata: ensure padatadoserial runs on the correct CPU - Bluetooth: L2CAP: Fix...

CLSA-2025-1763991095 Fix of 25 CVEs

Focal update: v5.4.291 upstream stable release LP: 2106002 // CVE-2025-21772 - partitions: mac: fix handling of bogus partition table CVE-url: https://ubuntu.com/security/CVE-2025-22079 - ocfs2: validate ltreedepth to avoid out-of-bounds access CVE-url: https://ubuntu.com/security/CVE-2024-58014 ...

CLSA-2025-1763990271 Fix of 12 CVEs

Focal update: v5.4.291 upstream stable release LP: 2106002 // CVE-2024-58072 - wifi: rtlwifi: remove unused checkbuddypriv Focal update: v5.4.291 upstream stable release LP: 2106002 - wifi: rtlwifi: remove unused timer and related code - wifi: rtlwifi: remove unused dualmac control leftovers Foca...

CLSA-2025-1763032400 mod_jk: Fix of CVE-2023-41081

CVE-2023-41081: fix authentication bypass by removing implicit mapping functionality in modjk...

CLSA-2025-1762539123 git-lfs: Fix of 6 CVEs

Rebuild with golang = 1.22.5.tuxcare.els7 to fix CVE-2024-24790, CVE-2024-34156, CVE-2023-45288, CVE-2023-39322, CVE-2023-39321, CVE-2024-24788...

CLSA-2025-1760362202 Update of kernel

Rebased FIPS patches to 5.14.0-570.51.1...

CLSA-2025-1760022663 libtiff: Fix of CVE-2017-5225

CVE-2017-5225: fix heap buffer overflow in tools/tiffcp by restricting BitsPerSample values...

CLSA-2025-1759780820 python3: Fix of CVE-2007-4559

CVE-2007-4559: implement PEP 706 - a filter in the tarfile module to prevent directory traversal vulnerability...

CLSA-2025-1758744098 gimp: Fix of CVE-2025-48797

CVE-2025-48797: fix TGA loader buffer overflows by validating colormap alpha, color IDs, bytes-per-pixel, and limiting error messages...

CLSA-2025-1758615308 libwebp: Fix of CVE-2020-36328

CVE-2020-36328: fix a heap-based buffer overflow in WebPDecodeInto functions...

CLSA-2025-1758289801 Fix CVE(s): CVE-2025-53101

SECURITY UPDATE: stack overflow via multiple consecutive %d format specifiers in filename template - debian/patches/CVE-2025-53101.patch: Fix image filename interpretation issue by adjusting the offset value - CVE-2025-53101...

CLSA-2025-1756482270 kernel: Fix of CVE-2024-2201

spec: up spec/misc to 1160.136.1, spectre mitigation is off by default - hugetlb, mempolicy: fix the mbind hugetlb migration - net: atm: fix use after free in lecsend - net: atlantic: fix aqvec index out of range error - block: initialize flush request via blkmqrqctxinit - ALSA: usb-audio: Fix a...

CLSA-2025-1758031207 httpd: Fix of 2 CVEs

CVE-2024-47252: escape characters are now properly handled in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to mitigate HTTP desynchronisation attack...

CLSA-2025-1757490210 Fix CVE(s): CVE-2025-1735

SECURITY UPDATE: inadequate validation in pgsql and pdopgsql functions - debian/patches/CVE-2025-1735.patch: Add error checks for escape function in pgsql and pdopgsql extensions to prevent potential security issues - CVE-2025-1735...

CLSA-2025-1757411402 Fix CVE(s): CVE-2025-53014

SECURITY UPDATE: heap buffer overflow in InterpretImageFilename function - debian/patches/CVE-2025-53014.patch: Correct out of bounds read of a single byte in InterpretImageFilename function - CVE-2025-53014...

CLSA-2025-1757015024 squid: Fix of CVE-2025-54574

CVE-2025-54574: fix heap buffer overflow in URN parsing...

CLSA-2025-1753799434 java-1.8.0-openjdk: Fix of 19 CVEs

Security fixes from OpenJDK 8u452-b09: - CVE-2025-21587: JSSE issue allowing remote access or modification of sensitive data - CVE-2025-30698: allows limited data access and partial DoS via untrusted Java code - CVE-2025-30691: allows limited data access via untrusted code using compiler APIs -...

CLSA-2025-1742472545 kernel: Fix of 9 CVEs

USB: serial: ioedgeport: fix use after free in debug printk CVE-2024-50267 - HID: core: zero-initialize the report buffer CVE-2024-50302 - dm cache: fix potential out-of-bounds access on the first resume CVE-2024-50278 - dm cache: fix out-of-bounds access to the dirty bitset when resizing...

CLSA-2025-1741126677 python3.11: Fix of 3 CVEs

CVE-2024-4032: update 'ipaddress' module to correct isprivate and isglobal properties based on latest IANA information - CVE-2024-6923: properly quote newlines for email headers to prevent header injection - CVE-2024-8088: fix issue causing infinite loop when iterating over names of entries in a...

CLSA-2025-1739292069 kernel: Fix of 13 CVEs

media: uvcvideo: Skip parsing frames of type UVCVSUNDEFINED in uvcparseformat CVE-2024-53104 - btrfs: fix information leak in btrfsioctllogicaltoino CVE-2024-35849 - net: afcan: do not leave a dangling sk pointer in cancreate CVE-2024-56603 - netfilter: xtables: fix LED ID check in ledtgcheck...

CLSA-2025-1738663576 kernel: Fix of 11 CVEs

ELF: fix kernel.randomizevaspace double read CVE-2024-46826 - smb: client: fix UAF in async decryption CVE-2024-50047 - SMB3: Resolve data corruption of TCP server info fields CVE-2024-50047 - smb3: add defines for new crypto algorithms CVE-2024-50047 - net: do not delay dstentriesadd in...

CLSA-2024-1732197150 Fix of 20 CVEs

Update to 8u432-ga fixing a number of CVEs - CVE-2024-20918: missing array range check in C1 compiler leads to out-of-bounds access - CVE-2024-20919: unverified bytecode execution because of the flaw in JVM class file verifier - CVE-2024-20921: optimization issue of loop range check in IfNode and...

CLSA-2024-1725385588 clamav: Fix of 2 CVEs

Update to 0.103.11 - CVE-2023-20032: fix missing buffer size check that may result in a heap buffer overflow write - Don't apply clamav-check.patch and CVE-2022-20698.patch as they have already been applied in new 0.103.11 version - Don't apply clamav-clamonacc-service.patch since el6 doesn't...

CLSA-2024-1724266264 grub2: Fix of 12 CVEs

Fix package version number - Use CloudLinux vendor cert - Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel - Add patches from centos-8.5 ELS: - CVE-2021-3695: out-of-bounds write in the heap area by a crafted 16-bit grayscale PNG image -...

CLSA-2024-1711026398 kernel: Fix of 7 CVEs

netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one CVE-2023-39197 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-2023-52449 - media: pvrusb2: fix use after free on context disconnection CVE-2023-52445 - net: prevent mss overflow in skbsegment...

CLSA-2024-1710947240 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-52449 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-url: https://ubuntu.com/security/CVE-2023-39197 - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one CVE-url:...

CLSA-2024-1708638566 openssh: Fix of CVE-2023-48795

CVE-2023-48795: implement "strict key exchange" in ssh and sshd...

CLSA-2024-1707420183 Fix CVE(s): CVE-2023-48795

SECURITY UPDATE: it's possible to remove the initial messages on the secure channel without causing a MAC failure - debian/patches/CVE-2023-48795.patch: implement "strict key exchange" in ssh and sshd - CVE-2023-48795...

CLSA-2024-1706697909 java-1.8.0-openjdk: Fix of 8 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06. That fixes following CVEs: - CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler - CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution - CVE-2024-20921: Range check loop...

CLSA-2024-1705081763 Fix of 7 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-7192 - netfilter: ctnetlink: fix possible refcount leak in ctnetlinkcreateconntrack CVE-url: https://ubuntu.com/security/CVE-2023-6610 - smb: client: fix potential OOB in smb2dumpdetail CVE-url: https://ubuntu.com/security/CVE-2023-6606 - smb: client:...

CLSA-2023-1701799960 Fix of 8 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-45871 - igb: Limit maximum frame Rx based on MTU - igb: Only sync size of expected frame in ethtool testing - igb: Add support for ethtool private flag to allow use of legacy Rx - igb: Add support for using order 1 pages to receive large frames - igb:...

CLSA-2023-1694536738 binutils: Fix of 3 CVEs

CVE-2022-47673: Fix multiple out of bound reads which may cause a DoS - CVE-2022-47695: Fix NULL pointer segmentation fault which may cause a DoS - CVE-2022-47696: Fix read of unitialized field which may cause a DoS...

CLSA-2023-1694109571 Fix CVE(s): CVE-2023-20569, CVE-2023-20593

New microcode update packages from AMD upstream up to 2023-08-08: + New Microcodes for 19h family: sig 0x00a10f11, sig 0x00a10f12, sig 0x00aa0f01, sig 0x00aa0f02; SECURITY UPDATE: A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction...

CLSA-2023-1693333992 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-4128 - net/sched: clsu32: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsfw: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsroute: No longer copy tcfresult on update to avoid use- after-free...

CLSA-2023-1683146027 kernel: Fix of 23 CVEs

media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-26545 - net/ulp: prevent ULP without clone op from entering the LISTEN status CVE-2023-0461 - Bluetooth: L2CAP: Fix u8 overflow CVE-2022-45934 -...

CLSA-2023-1682416329 Fix CVE(s): CVE-2023-26545, CVE-2022-3903, CVE-2023-1281

Ubuntu: 4.15.0-209.220 bionic/linux: 4.15.0-209.220 -proposed tracker LP: 2011989 CVE-2023-26545 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-1281 - rcu: Upgrade rcuswapprotected to rcureplacepointer - net/sched: tcindex: update imperfect hash filters respectin...

CLSA-2023-1679350239 systemd: Fix of CVE-2023-26604

CVE-2023-26604: prevent a priveledge escalation in a pager sub-process - testlogin was updated...

CLSA-2022-1662658348 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server MITM attack, refactoring - fix test-system components, enable 'daemon' and 'hardlinks' tests...

CLSA-2022-1652987360 Fixed CVE-2018-25032 in rsync

CVE-2018-25032: zlib: A flaw found in zlib when compressing not decompressing certain inputs...

CLSA-2022-1650377026 Fix of CVE: CVE-2021-3609, CVE-2022-28390

can: emsusb: emsusbstartxmit: fix double devkfreeskb in error path ELSCVE-3847 CVE-2022-28390 - can: bcm: delay release of struct bcmop after synchronizercu ELSCVE-1694 CVE-2021-3609...

CLSA-2022-1646935759 Update of ca-certificates

remove old certificate - Removing: - Certificate "DST Root CA X3" - Update to CKBI 2.50 from NSS 3.67 - Update to CKBI 2.48 from NSS 3.66 - Removing: - Certificate "Verisign Class 3 Public Primary Certification Authority - G3" - Certificate "GeoTrust Global CA" - Certificate "GeoTrust Universal...

CLSA-2022-1646060667 Fix of CVE: CVE-2021-42574, CVE-2018-20673

CVE-2021-42574: Developer environment: Unicode's bidirectional BiDi override characters can cause trojan source attacks 2008391 - CVE-2018-20673: libiberty: Integer overflow in demangletemplate function 1668394...