CLSA-2025-1765898379 java-1.8.0-openjdk: Fix of 2 CVEs

Upgrade to shenandoah-jdk8u472-b08 GA fixing the following CVEs: - CVE-2025-53057: enhance certificate handling - CVE-2025-53066: enhance Path Factories...

CLSA-2025-1763032400 mod_jk: Fix of CVE-2023-41081

CVE-2023-41081: fix authentication bypass by removing implicit mapping functionality in modjk...

CLSA-2025-1762539123 git-lfs: Fix of 6 CVEs

Rebuild with golang = 1.22.5.tuxcare.els7 to fix CVE-2024-24790, CVE-2024-34156, CVE-2023-45288, CVE-2023-39322, CVE-2023-39321, CVE-2024-24788...

CLSA-2025-1757411402 Fix CVE(s): CVE-2025-53014

SECURITY UPDATE: heap buffer overflow in InterpretImageFilename function - debian/patches/CVE-2025-53014.patch: Correct out of bounds read of a single byte in InterpretImageFilename function - CVE-2025-53014...

CLSA-2025-1757148344 Update of kernel

Rebased FIPS patches to 5.14.0-570.35.1...

CLSA-2025-1753297988 kernel: Fix of 17 CVEs

Bluetooth: Fix use after free in hcisendacl CVE-2022-49111 - drm/amd/display: clear optc underflow before turn off odm clock CVE-2022-49969 - NFSv4/pnfs: Fix a use-after-free bug in open CVE-2022-50072 - NFSv4: Don't hold the layoutget locks across multiple RPC calls CVE-2022-50072 - tty: ngsm:...

CLSA-2025-1749482356 openssh: Fix of CVE-2025-32728

CVE-2025-32728: fix logic error in DisableForwarding option...

CLSA-2025-1748627842 Update of linux-firmware

Addition AMD CPU microcode for processor family 0x19: cpuid:0x00A70FC0ver:0x0A70C005, cpuid:0x00A70F52ver:0x0A705206, cpuid:0x00A00F82ver:0x0A00820C, cpuid:0x00A40F41ver:0x0A404107, cpuid:0x00A70F80ver:0x0A708007, cpuid:0x00A20F10ver:0x0A20102D, cpuid:0x00A70F41ver:0x0A704107,...

CLSA-2025-1747260502 kernel: Fix of 5 CVEs

ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices CVE-2024-53197 - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd CVE-2025-21969 - ext4: fix OOB read when checking dotdot dir CVE-2025-37785 - iscsiibft: Fix UBSAN shift-out-of-bounds warning in...

CLSA-2024-1732196856 Fix CVE(s): CVE-2024-52533

SECURITY UPDATE: Buffer overflow - debian/patches/CVE-2024-52533.patch: Fix a single byte buffer overflow in connect messages in gsocks4aproxy - CVE-2024-52533...

CLSA-2024-1730917116 Update of ca-certificates

update to CKBI 2.70 from NSS 3.106 - updated certificates: - Certificate "GLOBALTRUST 2020" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Baltimore CyberTrust...

CLSA-2024-1726058957 java-1.8.0-openjdk: Fix of 6 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u422-b05. That fixes following CVEs: - CVE-2024-21131: UTF8 size overflow - CVE-2024-21138: Infinite loop vunlerability in SymbolTable - CVE-2024-21140: Int overflow/underflow in Range Check Elimination RCE - CVE-2024-21144: Invalid header...

CLSA-2024-1724693366 kernel: Fix of 15 CVEs

net: ice: Fix potential NULL pointer dereference in icebridgesetlink CVE-2024-26855 - tty: Fix out-of-bound vmalloc access in imageblit CVE-2021-47383 - drm/vmwgfx: Fix invalid reads in fence signaled events CVE-2024-36960 - Revert: GFS2: Skip dlmunlock calls during unmount CVE-2024-38570 -...

CLSA-2024-1722523708 Fix of 10 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-25744 - x86/sev: Rename memencrypt.c to memencryptamd.c - x86: Introduce ia32enabled - x86/coco: Disable 32-bit emulation by default on TDX and SEV CVE-url: https://ubuntu.com/security/CVE-2024-36016 - tty: ngsm: fix frame reception handling - tty:...

CLSA-2024-1706697909 java-1.8.0-openjdk: Fix of 8 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06. That fixes following CVEs: - CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler - CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution - CVE-2024-20921: Range check loop...

CLSA-2023-1702573569 Fix of 5 CVEs

SECURITY UPDATE: Update to 5.7.44 to fix security issues - CVE-2023-22053, CVE-2023-22084, CVE-2023-22015, CVE-2023-22026, CVE-2023-22028 debian/patches/offroottests.patch: disable mysqlddaemon and mysqldsafe tests under root due to known issues with these tests...

CLSA-2023-1699380056 rsync: Fix of 2 CVEs

CVE-2018-25032: fix a bug that can crash deflate on some input when using ZFIXED - CVE-2022-37434: fix zlib bug with a large gzip header extra field...

CLSA-2023-1697742241 Fix CVE(s): CVE-2023-44487

SECURITY UPDATE: The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly - debian/patches/CVE-2023-44487.patch: HTTP/2 - per-iteration stream handling limit. - CVE-2023-44487...

CLSA-2023-1694536738 binutils: Fix of 3 CVEs

CVE-2022-47673: Fix multiple out of bound reads which may cause a DoS - CVE-2022-47695: Fix NULL pointer segmentation fault which may cause a DoS - CVE-2022-47696: Fix read of unitialized field which may cause a DoS...

CLSA-2023-1691081639 java-1.8.0-openjdk: Fix of 2 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u382-b05. That fixes following CVEs: - CVE-2023-22045: Array indexing integer overflow issue. 8304468 - CVE-2023-22049: Improper handling of slash characters in URI-to-path conversion 8305312 - Remove patch for pkcs11 cause issue was fixed in...

CLSA-2023-1682605601 Fix of 53 CVEs

CVE-2022-1198 - drivers: hamradio: 6pack: fix UAF bug caused by modtimer Bionic update: upstream stable patchset 2022-03-04 LP: 1963717 // CVE-2020-36516 - ipv4: avoid using shared IP generator for connected sockets CVE-2022-36879 - xfrm: xfrmpolicy: fix a possible double xfrmpolsput in...

CLSA-2022-1656447241 Fixed CVEs in httpd: CVE-2022-31813, CVE-2022-28615, CVE-2022-26377

CVE-2022-26377: modproxyajp: fix HTTP request smuggling - CVE-2022-28615: fix possible out-of-bounds read in apstrcmpmatch - CVE-2022-31813: modproxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded- headers correctly...

CLSA-2022-1646935759 Update of ca-certificates

remove old certificate - Removing: - Certificate "DST Root CA X3" - Update to CKBI 2.50 from NSS 3.67 - Update to CKBI 2.48 from NSS 3.66 - Removing: - Certificate "Verisign Class 3 Public Primary Certification Authority - G3" - Certificate "GeoTrust Global CA" - Certificate "GeoTrust Universal...

CLSA-2022-1646060667 Fix of CVE: CVE-2021-42574, CVE-2018-20673

CVE-2021-42574: Developer environment: Unicode's bidirectional BiDi override characters can cause trojan source attacks 2008391 - CVE-2018-20673: libiberty: Integer overflow in demangletemplate function 1668394...

CLSA-2022-1645466687 Fix of CVE: CVE-2021-28153, CVE-2021-3800

CVE-2021-28153: gfilereplace with GFILECREATEREPLACEDESTINATION creates empty target for dangling symlink 1939118 - CVE-2021-3800: Possible privilege escalation thourgh pkexec and aliases 1938284...

CLSA-2021-1638803819 Fix of 56 CVEs

CVE-2017-7223: Fix global buffer overflow of size 1 - CVE-2017-7224: Fix invalid write of size 1 while disassembling - CVE-2017-7225: Fix NULL pointer dereference and an invalid write - CVE-2017-7226: Fix heap-based buffer over-read of size 4049 - CVE-2017-7227: Fix heap-based buffer overflow -...

CLSA-2021-1634925704 Fixed CVE-2021-23240 in sudo

sudo-1.8.6p3-CVE-2021-23240-2.patch: fixed issue with credentials management in sudoedit - sudo-1.8.6p3-CVE-2021-23240-3.patch: fixed issue with origin file removal in sesh...

CLSA-2026-1790875447 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.16-tuxcare.1...

CLSA-2026-1789663751 TuxCare security update for org.springframework.ws (2 CVEs)

TuxCare rebuilt 6 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.14-tuxcare.1...

CLSA-2026-1787930548 TuxCare security update for django (7 CVEs)

TuxCare rebuilt django to address 7 CVEs. Fixed in 5.0.2.post5+tuxcare...

CLSA-2026-1784682948 TuxCare security update for craftcms/cms (14 CVEs)

TuxCare rebuilt craftcms/cms to address 14 CVEs. Fixed in 3.9.15-p7+tuxcare...

CLSA-2026-1776127989 TuxCare security update for saloonphp/saloon (3 CVEs)

TuxCare rebuilt saloonphp/saloon to address 3 CVEs. Fixed in 3.15.0-p1+tuxcare...

CLSA-2026-1780132159 Fix of 7 CVEs

CVE-2026-23193 - scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount CVE-2026-23193 CVE-2025-71093 - e1000: fix OOB in e1000tbishouldaccept CVE-2025-71093 CVE-2025-71116 - libceph: make decodepool more resilient against corrupted osdmaps CVE-2025-71116 CVE-2025-71136 - media:...

CLSA-2026-1779580341 qemu-kvm: Fix of CVE-2025-11234

CVE-2025-11234: io: use-after-free in websocket handshake code - Bump leading release 14 - 15 to overcome rpm-version-rank trap: previously released wrong-dist builds tagged .el9 outrank the correctly-tagged .el92 builds, blocking the proper release to stable. No source/code changes vs els9...

CLSA-2026-1779533909 unbound: Fix of 3 CVEs

CVE-2026-33278: dangling pointer dereference in dnsmsgdeepcopyregion during DS sub-query suspend/resume; the previously-backported CVE-2023-50387-CVE-2023-50868.patch dragged the vulnerable 'res-rep = origin-rep;' struct-assignment into our 1.16.2 tree. Save the destination rrsets pointer,...

CLSA-2026-1779465604 postgresql: Fix of CVE-2026-6473

CVE-2026-6473: tsearch: bound StartSel/StopSel/FragmentDelimiter length to PGINT16MAX in tsheadline - CVE-2026-6473: contrib/ltree: guard lquery parsing against numvar and totallen wraparound - CVE-2026-6473: regex: add overflow-checked MALLOCARRAY/REALLOCARRAY and bound NFA state/color products...

CLSA-2025-1754342894 php: Fix of CVE-2025-6491

CVE-2025-6491: fix buffer overflow vulnerability...

CLSA-2026-1779216196 libssh2: Fix of CVE-2026-7598

CVE-2026-7598: fix integer overflow in userauthpassword CVE-2026-7598...

CLSA-2026-1779183996 expat: Fix of CVE-2026-45186

CVE-2026-45186: fix quadratic complexity in attribute name collision check...

CLSA-2026-1779127684 ImageMagick: Fix of CVE-2026-42050

CVE-2026-42050: fix stack buffer overflow in XTileImage when loading malicious MIFF in display tool...

CLSA-2026-1778769563 python: Fix of 4 CVEs

CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection - CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new validatehost helper to prevent CRLF header injection the glibc...

CLSA-2026-1778219103 glib2: Fix of CVE-2025-4373

CVE-2025-4373 fix buffer underflow in gstringinsertunichar and other GString APIs by carefully handling gssize parameters in glib/gstring.c...

CLSA-2026-1778175067 cyrus-sasl: Fix of CVE-2019-19906

CVE-2019-19906: fix off-by-one in sasladdstring lib/common.c that could cause denial of service or information disclosure via crafted input...

CLSA-2026-1778002331 python3: Fix of CVE-2026-4519

CVE-2026-4519: reject leading dashes in webbrowser URLs to prevent CLI option injection in pydoc/subprocess...

CLSA-2026-1772575666 containernetworking-plugins: Fix of 3 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE - CVE-2025-61729: fix excessive resource consumption when constructing hostname error messages for certificates with many SANs - CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory...

CLSA-2026-1778003186 libssh: Fix of CVE-2026-0966

CVE-2026-0966: fix heap buffer underflow in sshgethexa on NULL or zero-length input, remotely reachable via GSSAPI authentication logging...

CLSA-2026-1777614493 ansible: Fix of CVE-2019-14904

CVE-2019-14904: validate solariszone name to prevent command injection...

CLSA-2026-1777637310 Fix of 13 CVEs

CVE-2026-31431 - crypto: authencesn - reject too-short AAD assoclen8 to match ESP/ESN spec CVE-2026-31431 - crypto: scatterwalk - Backport memcpysglist CVE-2026-31431 - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption CVE-2026-31431 - crypto: authencesn - Fix src...

CLSA-2026-1777297012 openssl: Fix of 3 CVEs

CVE-2026-28388: fix NULL dereference in checkdeltabase when a Delta CRL lacks the CRL Number extension - CVE-2026-28389: fix NULL dereference in dh/ecdhcmssetsharedinfo when KeyEncryptionAlgorithmIdentifier has no parameters field - CVE-2026-28390: fix NULL dereference in rsacmsdecrypt when the...

CLSA-2026-1777047310 ImageMagick: Fix of 5 CVEs

CVE-2026-33900: fix integer truncation in viff encoder leading to heap out-of-bounds write on 32-bit builds - CVE-2026-33905: fix out-of-bounds read in -sample operation via sample:offset define - CVE-2026-34238: fix integer overflow in despeckle operation causing heap buffer overflow on 32-bit...