CLSA-2026-1772642715 Update of alt-php

Update ca-certificates database to 20260129: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.82. - The following certificates were updated: Certificate "GlobalSign Root CA" Certificate "Entrust.net Premium 2048 Secure Server CA" Certificate "Comodo AAA...

CLSA-2026-1772464786 grafana: Fix of CVE-2025-68121

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE's - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry...

CLSA-2026-1771855171 glib2: Fix of CVE-2025-14087

CVE-2025-14087: fix integer overflow in GVariant parser leading to heap corruption via buffer underflow when processing malicious input strings...

CLSA-2026-1772146691 libpng: Fix of CVE-2026-25646

CVE-2026-25646: fix a heap buffer overflow in pngsetquantize...

CLSA-2026-1772114900 glibc: Fix of CVE-2026-0915

CVE-2026-0915: fix leak of stack contents to configured DNS resolver when resolving a zero-valued network via getnetbyaddr/getnetbyaddrr with DNS NSS backend; sanitize network value and avoid passing uninitialized stack data to resolver...

CLSA-2026-1772113038 Fix of 12 CVEs

OpenJDK 8u482 release, build 8. Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html - Security fixes 8u482: + CVE-2026-21945: Prevent DoS via repeated crash or hang in sandbox security + CVE-2026-21932: Fix integrity issue in sandboxed handling of untrusted input ...

CLSA-2026-1772098033 python2: Fix of CVE-2025-15367

CVE-2025-15367: reject control characters in POP3 commands to prevent command injection via embedded newlines...

CLSA-2026-1772040065 grafana-pcp: Fix of 2 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els5 to fix the following CVE's - CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing - CVE-2025-61729: fix excessive resource consumption when constructing hostname error messages...

CLSA-2026-1771925958 python2: Fix of 2 CVEs

CVE-2026-1299: reject email header values containing newlines without whitespace to prevent header injection and info leak via the buffer protocol - CVE-2024-6923: ensure email headers are encoded and verified correctly, raising exceptions for malformed input to prevent processing of invalid or...

CLSA-2026-1771663697 curl: Fix of 2 CVEs

CVE-2025-14524: fix OAuth2 bearer token leak on cross-protocol redirect - CVE-2025-15224: fix libssh public-key auth fallback to SSH agent...

CLSA-2026-1770310846 java-1.8.0-openjdk: Fix of 3 CVEs

Upgrade to shenandoah-jdk8u482-b08 GA fixing the following CVE: - CVE-2026-21945: enhance certificate checking - CVE-2026-21925: improve JMX connections - CVE-2026-21933: improve HttpServer request handling...

CLSA-2026-1771005847 Update of alt-php

Update ca-certificates database to 20260129: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.82. - The following certificates were updated: Certificate "GlobalSign Root CA" Certificate "Entrust.net Premium 2048 Secure Server CA" Certificate "Comodo AAA...

CLSA-2026-1770216604 Update of alt-php

New microcode update packages from upstream up to 2025-11-11: - New microcodes: sig 0x000a06e1, pfmask 0x97, 2025-06-27, rev 0x1000273, size 1635328 - Updated microcodes: sig 0x000606a6, pfmask 0x87, 2025-03-11, rev 0xd000410, size 309248 sig 0x000606c1, pfmask 0x10, 2025-03-06, rev 0x10002e0, si...

CLSA-2026-1770213436 Update of microcode_ctl

Update Intel CPU microcode to 20251111: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000410; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000650; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

CLSA-2026-1770119166 java-1.8.0-openjdk: Fix of CVE-2026-21945

Update to openjdk-shenandoah-jdk8u-shenandoah-jdk8u482-b03. - CVE-2026-21945: Security component vulnerability allowing unauthenticated attacker with network access to cause hang or crash DoS...

CLSA-2026-1768392809 git: Fix of CVE-2024-32021

CVE-2024-32021: fix symlink vulnerability allowing creation of hardlinks to arbitrary files in local source repository cloning...

CLSA-2026-1768223578 git: Fix of CVE-2024-32021

CVE-2024-32021: fix symlink bypass, abort when hardlinked source and target file differ...

CLSA-2026-1768211438 git: Fix of 2 CVEs

CVE-2025-52005: add sideband.allowControlCharacters config which gives a possibility to avoid control characters in sideband - CVE-2024-52006: fix newline confusion in credential helpers that can lead to credential exfiltration...

CLSA-2025-1765463110 kernel: Fix of 51 CVEs

Bluetooth: MGMT: Protect mgmtpending list with its own lock CVE-2025-38117 - padata: Fix pd UAF once and for all CVE-2025-38584 - wifi: cfg80211: Fix use after free for wext CVE-2023-53153 - padata: Fix list iterator in padatadoserial - padata: do not leak refcount in reorderwork CVE-2025-38031 -...

CLSA-2025-1765287627 Update of postgresql

Bump release to 9.2.24-9.0.3.tuxcare.els1...

CLSA-2025-1765214354 Update of java-1.8.0-openjdk

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u472-b08 GA...

CLSA-2025-1764858279 jackson-databind: Fix of 2 CVEs

Removed CVE-2020-36518.patch: jackson-databind 2.14.1-1 is not affected - Rebuilt with the CVE-2025-52999: fixed jackson-core version...

CLSA-2025-1764152728 osbuild-composer: Fix of CVE-2025-27144

CVE-2025-27144: fix memory exhaustion vulnerability when parsing compact JWS or JWE input by updating the code to split JWT tokens...

CLSA-2025-1764322066 gstreamer1: Fix of CVE-2024-47606

CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem - Fix documentation build with the newer gtk-doc...

CLSA-2025-1764026530 qt5-qtbase: Fix of CVE-2023-38197

CVE-2023-38197: fix infinite loops in recursive entity expansion...

CLSA-2025-1763734783 kernel: Fix of 64 CVEs

media: bttv: fix use after free error due to btv-timeout timer CVE-2023-52847 - firmware: armscpi: Ensure scpiinfo is not assigned if the probe fails CVE-2022-50087 - wifi: mwifiex: Fix OOB and integer underflow when rx packets CVE-2023-53226 - vsock: Fix transport TOCTOU CVE-2025-38461 - ALSA:...

CLSA-2025-1763716672 edk2: Fix of 7 CVEs

CVE-2023-45229: fix IPv6 malformed option handling to prevent parsing loop - CVE-2023-45230: fix DHCPv6 ServerID length validation to prevent buffer overflow - CVE-2023-45231: fix IPv6 Redirect bounds checks to avoid out-of-bounds access - CVE-2023-45232: fix IPv6 destination option parsing to...

CLSA-2025-1763033745 python: Fix of CVE-2025-8194

CVE-2025-8194: fix infinite loop and deadlock in TarFile extraction and entry enumeration APIs...

CLSA-2025-1762421840 skopeo: Fix of 2 CVEs

CVE-2024-3727: fix path traversal vulnerability with full digest validation in all containers/image transports - CVE-2025-27144: fix excessive memory consumption vulnerability in github.com/go-jose/go-jose/v3 library...

CLSA-2025-1761575970 Fix of 6 CVEs

SECURITY UPDATE: potential Denial of Service via TLS connection - debian/patches/CVE-2020-14058.patch: Fix sending of unknown validation errors to cert validator - CVE-2020-14058 SECURITY UPDATE: improper Validation of Specified Index leads to Denial of Service via TLS Handshake vulnerability -...

CLSA-2025-1761139764 kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...

CLSA-2025-1760645131 Fix of 11 CVEs

CVE-url: https://ubuntu.com/security/CVE-2022-43945 - NFSD: Protect against send buffer overflow in NFSv3 READ CVE-url: https://ubuntu.com/security/CVE-2025-21796 - nfsd: clear aclaccess/acldefault after releasing them CVE-url: https://ubuntu.com/security/CVE-2022-48827 - NFSD: Fix the behavior o...

CLSA-2025-1759857092 python3: Fix of CVE-2007-4559

CVE-2007-4559: implement PEP 706 - a filter in the tarfile module to prevent directory traversal vulnerability...

CLSA-2025-1759248934 python3: Fix of CVE-2025-8194

CVE-2025-8194: tarfile: validate archives to ensure non-negative member offsets...

CLSA-2025-1758916535 Fix CVE(s): CVE-2025-58060

SECURITY UPDATE: authentication bypass vulnerability - debian/patches/CVE-2025-58060.patch: block authentication using alternate method in scheduler/auth.c - CVE-2025-58060...

CLSA-2025-1758228035 Fix CVE(s): CVE-2025-7425

SECURITY UPDATE: memory corruption in attribute type handling - debian/patches/CVE-2025-7425.patch: guard against atype corruption to ensure proper ID cleanup and prevent heap-use-after-free - CVE-2025-7425...

CLSA-2025-1758035415 httpd: Fix of 2 CVEs

CVE-2024-47252: escape characters are now properly handled in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to mitigate HTTP desynchronisation attack...

CLSA-2025-1758020272 Update of alt-php

Bump ABI 5.4.0-221...

CLSA-2025-1757698525 gdk-pixbuf2: Fix of CVE-2025-7345

CVE-2025-7345: fix heap buffer overflow during base64 encoding in gdkpixbufjpegimageloadincrement...

CLSA-2025-1757663366 git: Fix of CVE-2024-50349

CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively...

CLSA-2025-1755516017 tomcat6: Fix of CVE-2025-24813

CVE-2025-24813: enhance lifecycle of temporary files used by partial PUT...

CLSA-2025-1754341122 java-1.8.0-openjdk: Fix of 4 CVEs

Update to shenandoah-jdk8u462-b08 GA - Security fixes from OpenJDK 8u462-b08: - CVE-2025-30749: fix 2D vulnerability allowing remote attackers to compromise JVM via network access - CVE-2025-30754: fix JSSE vulnerability allowing unauthorized data access via TLS connections - CVE-2025-30761: fix...

CLSA-2025-1753982295 java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 GA. That fixes following CVEs: - CVE-2025-30749: better Glyph drawing - CVE-2025-30754: enhance TLS protocol support - CVE-2025-30761: improve scripting supports - CVE-2025-50106: glyph out-of-memory access and crash...

CLSA-2025-1753953101 php: Fix of CVE-2025-1735

CVE-2025-1735: add error checking for pgsql extension escape functions, mainly to fix possible issues with multi-byte encoding of Postgres databases...

CLSA-2025-1753083608 Fix of 17 CVEs

Focal update: v5.4.292 upstream stable release LP: 2109357 // CVE-url: https://ubuntu.com/security/CVE-2025-37937 - objtool, media: dib8000: Prevent divide-by-zero in dib8000setdds Focal update: v5.4.287 upstream stable release LP: 2095145 // CVE-url: https://ubuntu.com/security/CVE-2024-53197 -...

CLSA-2025-1751913478 sudo: Fix of CVE-2025-32462

CVE-2025-32462: fix Local Privilege Escalation vulnerability via host option...

CLSA-2025-1749825355 rsync: Fix of CVE-2016-9840

CVE-2016-9840: fix improper pointer arithmetic in bundled zlib...

CLSA-2025-1749505823 gcc: Fix of CVE-2020-11023

CVE-2020-11023: sanitize HTML content passed to DOM manipulation methods to prevent execution of untrusted code...

CLSA-2025-1749480611 kernel: Fix of 25 CVEs

rcu-tasks: Fix showrcutaskstracegpkthread buffer overflow CVE-2024-38577 - tcp: fix mptcp DSS corruption due to large pmtu xmit CVE-2024-50083 - vsock: Keep the binding until socket destruction CVE-2025-21756 - memstick: rtsxusbms: Fix slab-use-after-free in rtsxusbmsdrvremove CVE-2025-22020 -...

CLSA-2025-1748626881 golang: Fix of 2 CVEs

CVE-2024-24789: fix zip parsing to reject EOCDR records with truncated comments - CVE-2024-9355: fix HMAC to pass initialized length to EVPDigestSignFinal, ensuring correct output handling...