CLSA-2026-1779097389 qemu-kvm: Fix of CVE-2023-6693

fix CVE-2023-6693: virtio-net stack overflow via large guesthdrlen...

CLSA-2026-1778943258 Fix CVE(s): CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568

SECURITY UPDATE: SOAP use-after-free with SOAPPERSISTENCESESSION - debian/patches/CVE-2026-7261.patch: skip zvalptrdtor on the persisted soapobj after header parsing failure when persistence is SOAPPERSISTENCESESSION - CVE-2026-7261 SECURITY UPDATE: SOAP use-after-free via Apache Map with duplica...

CLSA-2026-1778896895 kernel: Fix of 2 CVEs

ptrace: require CAPSYSPTRACE when task has no mm - net: udpoffload: propagate SKBFLSHAREDFRAG in skbgroreceivelist CVE-2026-46300 - can: raw: fix ro-uniq use-after-free in rawrcv CVE-2026-31532...

CLSA-2026-1778832730 kernel: Fix of CVE-2026-46300

net: skbuff: propagate shared-frag marker 8.x backport CVE-2026-46300...

CLSA-2026-1778768341 python: Fix of 4 CVEs

CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection - CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new validatehost helper to prevent CRLF header injection the glibc...

CLSA-2026-1778674879 opensc: Fix of CVE-2024-45619

CVE-2024-45619: fix incorrect access of initialized parts of partially filled buffers triggered by crafted APDU responses from USB devices or smart cards...

CLSA-2026-1778615531 podman: Fix of CVE-2026-25679

Rebuild with Go 1.25.7-1.el96.tuxcare.els2 to fix Go standard library CVE - CVE-2026-25679: reject invalid IPv6 host literals in net/url.Parse to prevent URL validation bypass...

CLSA-2026-1778493745 opensc: Fix of 5 CVEs

CVE-2024-45615: initialize uninitialized variables passed as arguments - CVE-2024-45616: fix insufficient control of APDU response buffer length - CVE-2024-45617: check return values to avoid uninitialized variable use - CVE-2024-45618: check return values in pkcs15-init to avoid uninitialized...

CLSA-2026-1778170790 quagga: Fix of CVE-2018-5381

CVE-2018-5381: bgpd capability parser can enter an infinite loop on invalid OPEN messages whose Multi-Protocol capability has an unrecognized AFI/SAFI, causing a denial of service...

CLSA-2026-1778129970 python3.11: Fix of 7 CVEs

CVE-2026-0672: reject control characters in http.cookies cookie names, values, and parameters to prevent header injection - CVE-2026-3644: reject control characters in Morsel.update, |= operator, and unpickling paths missed by CVE-2026-0672; add output validation to BaseCookie.jsoutput -...

CLSA-2026-1778127227 pcp: Fix of 2 CVEs

CVE-2024-45770: guard pmpost against symlink attacks on $PCPLOGDIR/NOTICES - CVE-2024-45769: harden libpcp pmDecodeValueSet to prevent heap corruption from crafted PDUs...

CLSA-2026-1777565595 vim: Fix of CVE-2026-33412

CVE-2026-33412: fix OS command injection via newline in glob by adding \n to SHELLSPECIAL in src/osunix.c so newlines are escaped before the pattern is passed to the user's shell...

CLSA-2026-1777543457 webkit2gtk3: Fix of 9 CVEs

Update to 2.50.6 to fix the following vulnerabilities WSA-2026-0001: - CVE-2025-43213: type confusion in JavaScriptCore fixed in 2.50.5 - CVE-2025-43214: out-of-bounds read in WebCore fixed in 2.50.5 - CVE-2025-43457: integer overflow in WebKit canvas rendering fixed in 2.50.6 - CVE-2025-43511:...

CLSA-2026-1777542477 Fix CVE(s): CVE-2026-28690

SECURITY UPDATE: stack buffer overflow in MNG/JNG encoder — missing NULL check after ImageToBlob in WriteOneJNGImage could propagate a NULL blob pointer into later stack buffer operations GHSA-7h7q-j33q-hvpf. - debian/patches/CVE-2026-28690.patch: bail out of WriteOneJNGImage when ImageToBlob...

CLSA-2026-1777539404 squid34: Fix of 12 CVEs

CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing - CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions - CVE-2018-19131: escape certificate field injection via %D in ERRSECURECONNECTFAIL page - CVE-2018-19132: fix memory...

CLSA-2026-1777481470 glibc: Fix of CVE-2021-3326

CVE-2021-3326: fix assertion failure in iconv ISO-2022-JP-3 module...

CLSA-2026-1777475754 glusterfs: Fix of 2 CVEs

CVE-2018-10923: posix: disable open/read/write on special files - CVE-2018-14651: server: don't allow '/' in basename...

CLSA-2026-1776937700 mysql: Fix of CVE-2019-2627

CVE-2019-2627: fix crash when mysql.user table has missing password column...

CLSA-2026-1775726631 binutils: Fix of 9 CVEs

CVE-2023-1972: fix heap buffer overflow in bfdelfslurpversiontables - CVE-2025-11412: fix out-of-bounds read in bfdelfgcrecordvtentry - CVE-2025-11413: fix out-of-bounds read in elflinkaddobjectsymbols - CVE-2025-11839: fix abort in tgtagtype with fuzzed input - CVE-2025-11840: fix SEGV from NULL...

CLSA-2026-1776940444 perl-XML-Parser: Fix of CVE-2006-10003

CVE-2006-10003: fix off-by-one heap buffer overflow in stserialstack growth check in Expat/Expat.xs startElement; also backport upstream follow-up 2abd177 to initialize stserialstacksize=1024 after allocation...

CLSA-2026-1776362968 Fix CVE(s): CVE-2026-0968

SECURITY UPDATE: heap read past bounds in sftpparselongname from malicious SFTP longname field - debian/patches/CVE-2026-0968.patch: validate longname pointer and longnamefield; bound string walks at NUL; fail if field not found - CVE-2026-0968...

CLSA-2026-1776349106 libtiff: Fix of 5 CVEs

CVE-2022-34526: fix stack buffer overflow in TIFFVGetField via invalid codec-specific tag - CVE-2023-2908: fix null pointer dereference in countInkNamesString in tifdir.c - CVE-2023-6277: prevent out-of-memory attacks by comparing allocation size with file size - CVE-2023-1916: fix out-of-bounds...

CLSA-2026-1776174115 squid: Fix of 3 CVEs

CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries - CVE-2026-33515: ICP: fix validation of packet sizes and URLs - CVE-2026-33526: do not escape malformed URI twice when sending ICP errors...

CLSA-2026-1772456640 podman: Fix of 4 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE's - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry - CVE-2025-61726: limit parsed URL query parameters to...

CLSA-2026-1772125283 nodejs: Fix of 4 CVEs

CVE-2025-23167: fix improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. - CVE-2025-59466: fix uncatchable stack overflow exceptions when asynchooks are enabled, preventing denial-of-service crashes in applications using AsyncLocalStorage or...

CLSA-2026-1771412755 Update of alt-php

Update ca-certificates database to 20260210: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.82. - The following certificates were updated: Certificate "Entrust Root Certification Authority" Certificate "ePKI Root Certification Authority" Certificate...

CLSA-2026-1771010063 Update of nss

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - added certificates: - Certificate "TrustAsia SMIME ECC Root CA" - Certificate "TrustAsia SMIME RSA Root CA" - Certificate "TrustAsia TLS ECC Root CA" - Certificate "TrustAsia TLS RSA...

CLSA-2026-1771001650 libpng: Fix of CVE-2026-22801

CVE-2026-22801: fix heap buffer over-read in pngimagewrite...

CLSA-2026-1770325139 Update of alt-php

New microcode update packages from upstream up to 2025-11-11: - New microcodes: sig 0x000606c1, pfmask 0x10, 2025-03-06, rev 0x10002e0, size 301056 sig 0x000806f4, pfmask 0x10, 2025-05-29, rev 0x2c000410, size 625664 sig 0x000806f4, pfmask 0x87, 2025-05-29, rev 0x2b000650, size 593920 sig...

CLSA-2026-1768930687 podman: Fix of CVE-2025-47913

CVE-2025-47913: fix ssh/agent client panic on unexpected message types...

CLSA-2026-1768815869 buildah: Fix of CVE-2025-47913

CVE-2025-47913: prevent ssh-agent panic by rejecting unexpected message types and returning a descriptive error instead...

CLSA-2026-1768565904 libpq: Fix of CVE-2025-12818

Update to 13.23 - CVE-2025-12818: fix integer overflow in allocation-size calculations...

CLSA-2026-1768556662 cups: Fix of CVE-2025-58436

CVE-2025-58436: fix unresponsive cupsd process caused by a slow client...

CLSA-2026-1768412660 python3.11: Fix of CVE-2025-13836

CVE-2025-13836: fixed memory exhaustion vulnerability when reading HTTP responses with malicious Content-Length headers...

CLSA-2026-1768300368 Fix CVE(s): CVE-2025-58436

SECURITY UPDATE: fix DoS by a client that connect to cupsd sends slow messages. - debian/patches/CVE-2025-58436.patch: fix unresponsive cupsd process caused by a slow client. - CVE-2025-58436. Fix test/run-stp-tests.sh - debian/patches/waiting-limit.patch: limit the waiting for a server dunring...

CLSA-2025-1765310530 Update of java-1.8.0-openjdk

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u472-b08 GA...

CLSA-2025-1765214354 Update of java-1.8.0-openjdk

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u472-b08 GA...

CLSA-2025-1765208529 vim: Fix of 2 CVEs

CVE-2025-53906: drop leading ../ on write of zipfiles, don't forcefully overwrite existing files - CVE-2025-29768: use glob '-' to protect filenames starting with '-'...

CLSA-2025-1764847045 jackson-annotations: Fix of CVE-2025-52999

Rebuilt with the CVE-2025-52999: fixed jackson-core version - Fixed build: removed unavailable jackson-parent dependencies...

CLSA-2025-1762537123 cups: Fix of CVE-2024-35235

CVE-2024-35235: patch arbitrary chmod vulnerability in cupsd process when starting server with symbolic link Listen configuration item...

CLSA-2025-1762180294 podman: Fix of CVE-2024-9676

CVE-2024-9676: fix symlink traversal vulnerability in containers/storage library to prevent hanging and denial of service when running malicious images via automatically assigned user namespace...

CLSA-2025-1761073890 Update of linux-firmware

Addition AMD CPU microcode for processor family 0x1a: cpuid:0x00B00F21ver:0x0B002151, cpuid:0x00B10F10ver:0x0B10104E; - Update AMD CPU microcode for processor family 0x19: cpuid:0x00A00F11ver:0x0A0011DE, cpuid:0x00A00F12ver:0x0A001247, cpuid:0x00A00F82ver:0x0A00820D,...

CLSA-2025-1760649038 Update of alt-php

Bump ABI 4.15.0-252...

CLSA-2025-1760647898 Fix of 22 CVEs

CVE-url: https://ubuntu.com/security/CVE-2022-43945 - NFSD: Protect against send buffer overflow in NFSv3 READ Focal update: v5.4.285 upstream stable release LP: 2089233 // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924 - fbdev: pxafb: Fix possible use after free in pxafbta...

CLSA-2025-1758041082 libsndfile: Fix of CVE-2024-50612

CVE-2024-50612: fix out-of-bounds read in vorbisanalysiswrote in oggvorbis.c...

CLSA-2025-1757690669 glibc: Fix of CVE-2019-9169

CVE-2019-9169: fix heap-based buffer over-read in proceednextnode in posix/regexec.c...

CLSA-2025-1755270847 perl: Fix of CVE-2025-40909

CVE-2025-40909: prevent race conditions during cloning dirhandles...

CLSA-2025-1754338597 Fix CVE(s): CVE-2025-6965

SECURITY UPDATE: excessive aggregate terms potentially leading to memory corruption - debian/patches/CVE-2025-6965.patch: fix a potential memory corruption if the number of aggregate terms in a query exceeds the maximum number of columns - CVE-2025-6965...

CLSA-2025-1753982295 java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 GA. That fixes following CVEs: - CVE-2025-30749: better Glyph drawing - CVE-2025-30754: enhance TLS protocol support - CVE-2025-30761: improve scripting supports - CVE-2025-50106: glyph out-of-memory access and crash...

CLSA-2025-1753729667 Fix CVE(s): CVE-2025-49794, CVE-2025-49796

SECURITY UPDATE: memory vulnerabilities in schematron - debian/patches/CVE-2025-49794CVE-2025-49796.patch: fix memory safety issues in xmlSchematronReportOutput when parsing XPath elements and memory corruption issue triggered by processing sch:name elements in input XML file - CVE-2025-49794 -...