CLSA-2026-1777565595 vim: Fix of CVE-2026-33412

CVE-2026-33412: fix OS command injection via newline in glob by adding \n to SHELLSPECIAL in src/osunix.c so newlines are escaped before the pattern is passed to the user's shell...

CLSA-2026-1777543457 webkit2gtk3: Fix of 9 CVEs

Update to 2.50.6 to fix the following vulnerabilities WSA-2026-0001: - CVE-2025-43213: type confusion in JavaScriptCore fixed in 2.50.5 - CVE-2025-43214: out-of-bounds read in WebCore fixed in 2.50.5 - CVE-2025-43457: integer overflow in WebKit canvas rendering fixed in 2.50.6 - CVE-2025-43511:...

CLSA-2026-1777542477 Fix CVE(s): CVE-2026-28690

SECURITY UPDATE: stack buffer overflow in MNG/JNG encoder — missing NULL check after ImageToBlob in WriteOneJNGImage could propagate a NULL blob pointer into later stack buffer operations GHSA-7h7q-j33q-hvpf. - debian/patches/CVE-2026-28690.patch: bail out of WriteOneJNGImage when ImageToBlob...

CLSA-2026-1777539404 squid34: Fix of 12 CVEs

CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing - CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions - CVE-2018-19131: escape certificate field injection via %D in ERRSECURECONNECTFAIL page - CVE-2018-19132: fix memory...

CLSA-2026-1777481470 glibc: Fix of CVE-2021-3326

CVE-2021-3326: fix assertion failure in iconv ISO-2022-JP-3 module...

CLSA-2026-1777475754 glusterfs: Fix of 2 CVEs

CVE-2018-10923: posix: disable open/read/write on special files - CVE-2018-14651: server: don't allow '/' in basename...

CLSA-2026-1777463410 dovecot: Fix of CVE-2017-15132

CVE-2017-15132: fix memory leak and hash-table use-after-free in authclientrequestabort lib-auth. Squashed upstream commits 1a29ed2f96da and a9b135760aea...

CLSA-2026-1777445847 grafana-pcp: Fix of CVE-2026-25679

Rebuild against recent Go compiler - CVE-2026-25679: fix net/url insufficient validation of host in url.Parse...

CLSA-2026-1776937700 mysql: Fix of CVE-2019-2627

CVE-2019-2627: fix crash when mysql.user table has missing password column...

CLSA-2026-1775726631 binutils: Fix of 9 CVEs

CVE-2023-1972: fix heap buffer overflow in bfdelfslurpversiontables - CVE-2025-11412: fix out-of-bounds read in bfdelfgcrecordvtentry - CVE-2025-11413: fix out-of-bounds read in elflinkaddobjectsymbols - CVE-2025-11839: fix abort in tgtagtype with fuzzed input - CVE-2025-11840: fix SEGV from NULL...

CLSA-2026-1776940444 perl-XML-Parser: Fix of CVE-2006-10003

CVE-2006-10003: fix off-by-one heap buffer overflow in stserialstack growth check in Expat/Expat.xs startElement; also backport upstream follow-up 2abd177 to initialize stserialstacksize=1024 after allocation...

CLSA-2026-1776349106 libtiff: Fix of 5 CVEs

CVE-2022-34526: fix stack buffer overflow in TIFFVGetField via invalid codec-specific tag - CVE-2023-2908: fix null pointer dereference in countInkNamesString in tifdir.c - CVE-2023-6277: prevent out-of-memory attacks by comparing allocation size with file size - CVE-2023-1916: fix out-of-bounds...

CLSA-2026-1776174115 squid: Fix of 3 CVEs

CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries - CVE-2026-33515: ICP: fix validation of packet sizes and URLs - CVE-2026-33526: do not escape malformed URI twice when sending ICP errors...

CLSA-2026-1772456640 podman: Fix of 4 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE's - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry - CVE-2025-61726: limit parsed URL query parameters to...

CLSA-2026-1772125283 nodejs: Fix of 4 CVEs

CVE-2025-23167: fix improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. - CVE-2025-59466: fix uncatchable stack overflow exceptions when asynchooks are enabled, preventing denial-of-service crashes in applications using AsyncLocalStorage or...

CLSA-2026-1771663697 curl: Fix of 2 CVEs

CVE-2025-14524: fix OAuth2 bearer token leak on cross-protocol redirect - CVE-2025-15224: fix libssh public-key auth fallback to SSH agent...

CLSA-2026-1771412755 Update of alt-php

Update ca-certificates database to 20260210: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.82. - The following certificates were updated: Certificate "Entrust Root Certification Authority" Certificate "ePKI Root Certification Authority" Certificate...

CLSA-2026-1771010063 Update of nss

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - added certificates: - Certificate "TrustAsia SMIME ECC Root CA" - Certificate "TrustAsia SMIME RSA Root CA" - Certificate "TrustAsia TLS ECC Root CA" - Certificate "TrustAsia TLS RSA...

CLSA-2026-1770325139 Update of alt-php

New microcode update packages from upstream up to 2025-11-11: - New microcodes: sig 0x000606c1, pfmask 0x10, 2025-03-06, rev 0x10002e0, size 301056 sig 0x000806f4, pfmask 0x10, 2025-05-29, rev 0x2c000410, size 625664 sig 0x000806f4, pfmask 0x87, 2025-05-29, rev 0x2b000650, size 593920 sig...

CLSA-2026-1770216604 Update of alt-php

New microcode update packages from upstream up to 2025-11-11: - New microcodes: sig 0x000a06e1, pfmask 0x97, 2025-06-27, rev 0x1000273, size 1635328 - Updated microcodes: sig 0x000606a6, pfmask 0x87, 2025-03-11, rev 0xd000410, size 309248 sig 0x000606c1, pfmask 0x10, 2025-03-06, rev 0x10002e0, si...

CLSA-2026-1768930687 podman: Fix of CVE-2025-47913

CVE-2025-47913: fix ssh/agent client panic on unexpected message types...

CLSA-2026-1768300368 Fix CVE(s): CVE-2025-58436

SECURITY UPDATE: fix DoS by a client that connect to cupsd sends slow messages. - debian/patches/CVE-2025-58436.patch: fix unresponsive cupsd process caused by a slow client. - CVE-2025-58436. Fix test/run-stp-tests.sh - debian/patches/waiting-limit.patch: limit the waiting for a server dunring...

CLSA-2026-1768223578 git: Fix of CVE-2024-32021

CVE-2024-32021: fix symlink bypass, abort when hardlinked source and target file differ...

CLSA-2025-1765310530 Update of java-1.8.0-openjdk

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u472-b08 GA...

CLSA-2025-1765214354 Update of java-1.8.0-openjdk

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u472-b08 GA...

CLSA-2025-1765208529 vim: Fix of 2 CVEs

CVE-2025-53906: drop leading ../ on write of zipfiles, don't forcefully overwrite existing files - CVE-2025-29768: use glob '-' to protect filenames starting with '-'...

CLSA-2025-1764847045 jackson-annotations: Fix of CVE-2025-52999

Rebuilt with the CVE-2025-52999: fixed jackson-core version - Fixed build: removed unavailable jackson-parent dependencies...

CLSA-2025-1764152728 osbuild-composer: Fix of CVE-2025-27144

CVE-2025-27144: fix memory exhaustion vulnerability when parsing compact JWS or JWE input by updating the code to split JWT tokens...

CLSA-2025-1762180294 podman: Fix of CVE-2024-9676

CVE-2024-9676: fix symlink traversal vulnerability in containers/storage library to prevent hanging and denial of service when running malicious images via automatically assigned user namespace...

CLSA-2025-1761673460 qemu-kvm: Fix of CVE-2024-7409

CVE-2024-7409: fix improper synchronization during socket closure to prevent DoS attack...

CLSA-2025-1760649038 Update of alt-php

Bump ABI 4.15.0-252...

CLSA-2025-1758041082 libsndfile: Fix of CVE-2024-50612

CVE-2024-50612: fix out-of-bounds read in vorbisanalysiswrote in oggvorbis.c...

CLSA-2025-1757698525 gdk-pixbuf2: Fix of CVE-2025-7345

CVE-2025-7345: fix heap buffer overflow during base64 encoding in gdkpixbufjpegimageloadincrement...

CLSA-2025-1757690669 glibc: Fix of CVE-2019-9169

CVE-2019-9169: fix heap-based buffer over-read in proceednextnode in posix/regexec.c...

CLSA-2025-1756324356 Fix CVE(s): CVE-2025-49630

SECURITY UPDATE: denial of service attack caused by untrusted clients triggering assertion in modproxyhttp2 - debian/patches/CVE-2025-49630.patch: tolerate missing host header in h2 proxy to fix issue with HTTP/0.9 request without Host header - CVE-2025-49630...

CLSA-2025-1755270847 perl: Fix of CVE-2025-40909

CVE-2025-40909: prevent race conditions during cloning dirhandles...

CLSA-2025-1753982295 java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 GA. That fixes following CVEs: - CVE-2025-30749: better Glyph drawing - CVE-2025-30754: enhance TLS protocol support - CVE-2025-30761: improve scripting supports - CVE-2025-50106: glyph out-of-memory access and crash...

CLSA-2025-1753953101 php: Fix of CVE-2025-1735

CVE-2025-1735: add error checking for pgsql extension escape functions, mainly to fix possible issues with multi-byte encoding of Postgres databases...

CLSA-2025-1753298958 libxml2: Fix of 2 CVEs

CVE-2025-49794: fix memory safety issues in xmlSchematronReportOutput when parsing XPath elements - CVE-2025-49796: fix memory corruption issue triggered by processing sch:name elements in input XML file...

CLSA-2025-1753208636 python3.9: Fix of 5 CVEs

CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517: fix multiple tarfile extraction filter bypasses filter="tar"/filter="data"...

CLSA-2025-1752576917 git: Fix of CVE-2025-48385

CVE-2025-48385: bundle-uri: fix arbitrary file writes via parameter injection...

CLSA-2025-1751551161 Update of grub2

Improve Xen detection so we don't set GRUBENABLEBLSCFG=false for HVM domU guests - Debrand for Cloudlinux...

CLSA-2025-1751142973 git: Fix of CVE-2024-52005

CVE-2024-52005: add configuration option to sanitize sideband channel payloads...

CLSA-2025-1749552061 openssh: Fix of CVE-2025-32728

CVE-2025-32728: fix logic error in DisableForwarding option...

CLSA-2025-1749548422 Fix of 14 CVEs

CVE-url: https://ubuntu.com/security/CVE-2025-21811 - nilfs2: protect access to buffers with no active references CVE-url: https://ubuntu.com/security/CVE-2025-21715 - net: davicom: fix UAF in dm9000drvremove CVE-url: https://ubuntu.com/security/CVE-2024-58083 - KVM: Explicitly verify target vCPU...

CLSA-2025-1747251218 kernel: Fix of 5 CVEs

ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices CVE-2024-53197 - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd CVE-2025-21969 - ext4: fix OOB read when checking dotdot dir CVE-2025-37785 - iscsiibft: Fix UBSAN shift-out-of-bounds warning in...

CLSA-2025-1745530844 libsoup: Fix of CVE-2024-52530

CVE-2024-52530: prevent HTTP request smuggling by properly handling '0' characters at the end of header names...

CLSA-2025-1744632481 tigervnc: Fix of CVE-2023-5380

CVE-2023-5380: xorg-x11-server: fix use-after-free flaw causing X server crash in specific multi-screen Zaphod mode configuration by handling window destruction properly...

CLSA-2025-1743184619 bind: Fix of CVE-2023-4408

Remove bind-9.11.4-CVE-2023-4408.patch which introduces an ABI change that breaks bind-dyndb-ldap - Enforce that bind-dyndb-ldap is updated after ABI changes introduced in 9.11.4-26.P2.15 update...

CLSA-2025-1742319076 Fix CVE(s): CVE-2023-44487

SECURITY UPDATE: The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly - debian/patches/CVE-2023-44487.patch: HTTP/2 - per-iteration stream handling limit. - CVE-2023-44487...