CLSA-2026-1787300455 TuxCare security update for django (11 CVEs)

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.9.post3+tuxcare...

CLSA-2026-1786371522 TuxCare security update for dompdf/dompdf (5 CVEs)

TuxCare rebuilt dompdf/dompdf to address 5 CVEs. Fixed in 3.1.0-p1+tuxcare...

CLSA-2026-1786361876 TuxCare security update for minimatch (5 CVEs)

TuxCare rebuilt minimatch to address 5 CVEs. Fixed in 0.2.5-tuxcare.1...

CLSA-2026-1784077476 TuxCare security update for symfony/yaml (2 CVEs)

TuxCare rebuilt symfony/yaml to address 2 CVEs. Fixed in v4.4.45-p1+tuxcare...

CLSA-2026-1782867618 TuxCare security update for highcharts (2 CVEs)

TuxCare rebuilt highcharts to address 2 CVEs. Fixed in 7.2.0-tuxcare.1...

CLSA-2026-1782089828 TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 3.25.76-tuxcare.1...

CLSA-2026-1780707089 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 10.1.0-tuxcare.1...

CLSA-2026-1778805967 TuxCare security update for uuid (1 CVE)

TuxCare rebuilt uuid to address 1 CVE. Fixed in 9.0.1-tuxcare.1...

CLSA-2026-1777855417 TuxCare security update for 5 packages (10 CVEs)

TuxCare rebuilt 5 packages to address 10 CVEs. Fixed in 1.9.2-tuxcare.1...

CLSA-2026-1777509609 TuxCare security update for spatie/browsershot (5 CVEs)

TuxCare rebuilt spatie/browsershot to address 5 CVEs. Fixed in 4.4.0-p2+tuxcare...

CLSA-2026-1774657371 TuxCare security update for jsonpath-plus (2 CVEs)

TuxCare rebuilt jsonpath-plus to address 2 CVEs. Fixed in 7.2.0-tuxcare.1...

CLSA-2026-1774484515 TuxCare security update for org.bouncycastle (1 CVE)

TuxCare rebuilt 12 org.bouncycastle packages to address 1 CVE. Fixed in 1.64-tuxcare.3...

CLSA-2026-1780391238 Fix CVE(s): CVE-2026-8376

SECURITY UPDATE: heap buffer overflow in the regexp compiler 32-bit - debian/patches/CVE-2026-8376.patch: guard against an SSizet overflow when sizing the joined fixed-substring buffer in Perlstudychunk in regcomp.c; backported from upstream commit 5e7f119eb2bb1181be908701f22bf7068e722f1c. -...

CLSA-2026-1779968889 Fix of 7 CVEs

SECURITY UPDATE: Authentication Bypass in digest authentication - debian/patches/CVE-2026-43512.patch: reject digest authentication attempts for unknown users in getDigest - CVE-2026-43512 SECURITY UPDATE: Account lockout bypass in LockOutRealm via case variation of user names -...

CLSA-2026-1779533209 NetworkManager: Fix of CVE-2024-6501

CVE-2024-6501: NULL pointer dereference of n-lldprx in nmlldpneighborparse when DEBUG logging is enabled, leading to denial-of-service on malformed LLDP packets...

CLSA-2026-1779438231 rsync: Fix of CVE-2026-43618

CVE-2026-43618: fix integer overflow in compressed-token decoder allowing memory disclosure via crafted compressed stream...

CLSA-2026-1779215759 libxml2: Fix of CVE-2022-49043

CVE-2022-49043: fix use-after-free in xmlXIncludeAddNode by deferring xmlFreeURI until after the error path has consumed the value...

CLSA-2026-1779204531 gdk-pixbuf2: Fix of CVE-2026-5201

CVE-2026-5201: fix heap buffer overflow due to unvalidated JPEG color component count in gdkpixbufjpegimageload...

CLSA-2026-1779181085 kernel-uek: Fix of CVE-2026-46333

ptrace: require CAPSYSPTRACE when task has no mm CVE-2026-46333...

CLSA-2026-1779179460 kernel: Fix of CVE-2026-46333

ptrace: require CAPSYSPTRACE when task has no mm CVE-2026-46333...

CLSA-2026-1779130193 vim: Fix of CVE-2022-3520

CVE-2022-3520: clamp bopend.col = 0 in doput to prevent Visual block put underflow...

CLSA-2026-1778979189 Fix CVE(s): CVE-2024-6232, CVE-2024-7592, CVE-2024-9287

SECURITY UPDATE: ReDoS in tarfile PAX header parsing - debian/patches/CVE-2024-6232.patch: rewrite Lib/tarfile.py PAX-record parser to scan length-prefixed records via a bounded regex headerlengthprefixre plus direct slicing, eliminating quadratic backtracking in three pre-existing regexes. Adapt...

CLSA-2026-1778943258 Fix CVE(s): CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568

SECURITY UPDATE: SOAP use-after-free with SOAPPERSISTENCESESSION - debian/patches/CVE-2026-7261.patch: skip zvalptrdtor on the persisted soapobj after header parsing failure when persistence is SOAPPERSISTENCESESSION - CVE-2026-7261 SECURITY UPDATE: SOAP use-after-free via Apache Map with duplica...

CLSA-2026-1778896895 kernel: Fix of 2 CVEs

ptrace: require CAPSYSPTRACE when task has no mm - net: udpoffload: propagate SKBFLSHAREDFRAG in skbgroreceivelist CVE-2026-46300 - can: raw: fix ro-uniq use-after-free in rawrcv CVE-2026-31532...

CLSA-2026-1778493745 opensc: Fix of 5 CVEs

CVE-2024-45615: initialize uninitialized variables passed as arguments - CVE-2024-45616: fix insufficient control of APDU response buffer length - CVE-2024-45617: check return values to avoid uninitialized variable use - CVE-2024-45618: check return values in pkcs15-init to avoid uninitialized...

CLSA-2026-1778489354 python2: Fix of CVE-2026-6100

CVE-2026-6100: defensively null bzs-nextin on the error path of BZ2Decompdecompress to align with upstream; the UAF window does not exist in Python 2.7 nextin is reassigned at function entry, lzma/gzip are not C extensions...

CLSA-2026-1778254382 buildah: Fix of CVE-2026-25679

rebuild on tuxcare9.6esu with newer golang version 1.25.7-1.el96.tuxcare.els2 to fix the following CVE: - CVE-2026-25679: fix insufficient validation of host/authority component in url.Parse - split golang BuildRequires by .el96 so each ELS platform pulls its own fixed golang version el96 -...

CLSA-2026-1778170790 quagga: Fix of CVE-2018-5381

CVE-2018-5381: bgpd capability parser can enter an infinite loop on invalid OPEN messages whose Multi-Protocol capability has an unrecognized AFI/SAFI, causing a denial of service...

CLSA-2026-1778129970 python3.11: Fix of 7 CVEs

CVE-2026-0672: reject control characters in http.cookies cookie names, values, and parameters to prevent header injection - CVE-2026-3644: reject control characters in Morsel.update, |= operator, and unpickling paths missed by CVE-2026-0672; add output validation to BaseCookie.jsoutput -...

CLSA-2026-1778127227 pcp: Fix of 2 CVEs

CVE-2024-45770: guard pmpost against symlink attacks on $PCPLOGDIR/NOTICES - CVE-2024-45769: harden libpcp pmDecodeValueSet to prevent heap corruption from crafted PDUs...

CLSA-2026-1778009078 vim: Fix of 5 CVEs

CVE-2022-2125: fix out-of-bounds read in getlispindent; break out of the inner loop on NUL byte indent.c, upstream patch 8.2.5122 - CVE-2021-3974: fix use-after-free in nfaregmatch when a substitute callback frees the regline during a mark comparison; save col and re-fetch rex.line via reggetline...

CLSA-2026-1777543457 webkit2gtk3: Fix of 9 CVEs

Update to 2.50.6 to fix the following vulnerabilities WSA-2026-0001: - CVE-2025-43213: type confusion in JavaScriptCore fixed in 2.50.5 - CVE-2025-43214: out-of-bounds read in WebCore fixed in 2.50.5 - CVE-2025-43457: integer overflow in WebKit canvas rendering fixed in 2.50.6 - CVE-2025-43511:...

CLSA-2026-1777542477 Fix CVE(s): CVE-2026-28690

SECURITY UPDATE: stack buffer overflow in MNG/JNG encoder — missing NULL check after ImageToBlob in WriteOneJNGImage could propagate a NULL blob pointer into later stack buffer operations GHSA-7h7q-j33q-hvpf. - debian/patches/CVE-2026-28690.patch: bail out of WriteOneJNGImage when ImageToBlob...

CLSA-2026-1777539404 squid34: Fix of 12 CVEs

CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing - CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions - CVE-2018-19131: escape certificate field injection via %D in ERRSECURECONNECTFAIL page - CVE-2018-19132: fix memory...

CLSA-2026-1777481470 glibc: Fix of CVE-2021-3326

CVE-2021-3326: fix assertion failure in iconv ISO-2022-JP-3 module...

CLSA-2026-1777475754 glusterfs: Fix of 2 CVEs

CVE-2018-10923: posix: disable open/read/write on special files - CVE-2018-14651: server: don't allow '/' in basename...

CLSA-2026-1776937700 mysql: Fix of CVE-2019-2627

CVE-2019-2627: fix crash when mysql.user table has missing password column...

CLSA-2026-1775726631 binutils: Fix of 9 CVEs

CVE-2023-1972: fix heap buffer overflow in bfdelfslurpversiontables - CVE-2025-11412: fix out-of-bounds read in bfdelfgcrecordvtentry - CVE-2025-11413: fix out-of-bounds read in elflinkaddobjectsymbols - CVE-2025-11839: fix abort in tgtagtype with fuzzed input - CVE-2025-11840: fix SEGV from NULL...

CLSA-2026-1776768816 libexif: Fix of 3 CVEs

CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote entry value handling - CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote handling - CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size checks...

CLSA-2026-1776362968 Fix CVE(s): CVE-2026-0968

SECURITY UPDATE: heap read past bounds in sftpparselongname from malicious SFTP longname field - debian/patches/CVE-2026-0968.patch: validate longname pointer and longnamefield; bound string walks at NUL; fail if field not found - CVE-2026-0968...

CLSA-2026-1776174115 squid: Fix of 3 CVEs

CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries - CVE-2026-33515: ICP: fix validation of packet sizes and URLs - CVE-2026-33526: do not escape malformed URI twice when sending ICP errors...

CLSA-2026-1774612633 gnupg2: Fix of CVE-2025-30258

CVE-2025-30258: fix verification DoS due to a malicious subkey in the keyring...

CLSA-2026-1774369958 openssh: Fix of CVE-2026-3497

CVE-2026-3497: replace incorrect use of sshpktdisconnect with sshpacketdisconnect and properly initialize variables...

CLSA-2026-1772456640 podman: Fix of 4 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE's - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry - CVE-2025-61726: limit parsed URL query parameters to...

CLSA-2026-1772125283 nodejs: Fix of 4 CVEs

CVE-2025-23167: fix improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. - CVE-2025-59466: fix uncatchable stack overflow exceptions when asynchooks are enabled, preventing denial-of-service crashes in applications using AsyncLocalStorage or...

CLSA-2026-1771840259 libpng: Fix of CVE-2026-25646

CVE-2026-25646: fix out-of-bounds read and potential heap buffer overflow in pngsetquantize caused by stale palette indices during color pruning...

CLSA-2026-1771412755 Update of alt-php

Update ca-certificates database to 20260210: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.82. - The following certificates were updated: Certificate "Entrust Root Certification Authority" Certificate "ePKI Root Certification Authority" Certificate...

CLSA-2026-1771010063 Update of nss

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - added certificates: - Certificate "TrustAsia SMIME ECC Root CA" - Certificate "TrustAsia SMIME RSA Root CA" - Certificate "TrustAsia TLS ECC Root CA" - Certificate "TrustAsia TLS RSA...

CLSA-2026-1771001650 libpng: Fix of CVE-2026-22801

CVE-2026-22801: fix heap buffer over-read in pngimagewrite...

CLSA-2026-1770325139 Update of alt-php

New microcode update packages from upstream up to 2025-11-11: - New microcodes: sig 0x000606c1, pfmask 0x10, 2025-03-06, rev 0x10002e0, size 301056 sig 0x000806f4, pfmask 0x10, 2025-05-29, rev 0x2c000410, size 625664 sig 0x000806f4, pfmask 0x87, 2025-05-29, rev 0x2b000650, size 593920 sig...