CLSA-2025-1750783474 ghostscript: Fix of CVE-2024-46953

CVE-2024-46953: fix integer overflow in parsing filename format string to prevent path truncation and possible code execution...

CLSA-2025-1750692029 glibc: Fix of CVE-2025-4802

CVE-2025-4802: fix untrusted LDLIBRARYPATH vulnerability in dynamically shared library loading in setuid binaries to prevent attacker control...

CLSA-2025-1750176020 kernel: Fix of 6 CVEs

pfifotailenqueue: Drop new packet when sch-limit == 0 CVE-2025-21702 - xfs: add bounds checking to xlogrecoverprocessdata CVE-2024-41014 - netfilter: validate user input for expected length CVE-2024-35896 - nfs: fix UAF in direct writes CVE-2024-26958 - Squashfs: check the inode number is not the...

CLSA-2025-1750172760 kernel: Fix of 4 CVEs

media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccoreinit CVE-2022-49478 - x86/kvm: Disable kvmclock on all CPUs on shutdown CVE-2021-47110 - cifs: fix potential double free during failed mount CVE-2022-49541 - drm/amd/pm: fix double free in siparsepowertable CVE-2022-49530...

CLSA-2025-1746190792 libreoffice: Fix of 2 CVEs

CVE-2022-38745: avoid unnecessary empty -Djava.class.path= - CVE-2024-3044: add notify for script execution...

CLSA-2025-1745585192 ruby: Fix of 3 CVEs

CVE-2025-27219: fix a potential Denial of Service DoS vulnerability in cookie parsing - CVE-2025-27220: fix ReDoS vulnerability exists in the escapeElement method - CVE-2025-27221: fix he URI handling methods URI.join, URImerge, URI+...

CLSA-2025-1744623473 python3.11: Fix of CVE-2024-7592

CVE-2024-7592: fix quadratic complexity in parsing "-quoted cookie values with backslashes...

CLSA-2024-1729546540 openssl: Fix of CVE-2024-6119

CVE-2024-6119: avoid type errors in EAI-related name check logic...

CLSA-2025-1742806909 kernel: Fix of 37 CVEs

HID: core: zero-initialize the report buffer CVE-2024-50302 - net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - bus: mhi: host: Add alignment check for event ring read pointer CVE-2023-52494 - net: sched: fix ets qdisc OOB Indexing CVE-2025-21692 - parport: Proper fix for...

CLSA-2025-1742661821 openssl: Fix of CVE-2024-2408

CVE-2024-2408: introduce implicit rejection mechanism for RSA PKCS1 v1.5...

CLSA-2025-1742391294 binutils: Fix of CVE-2025-0840

CVE-2025-0840: fix stack-based buffer overflow in disassemblebytes function...

CLSA-2025-1741629749 libxml2: Fix of CVE-2025-27113

CVE-2025-27113: fix compilation of explicit child axis...

CLSA-2025-1741779966 binutils: Fix of CVE-2025-0840

CVE-2025-0840: fix stack-buffer-overflow at objdump disassemblebytes...

CLSA-2025-1741286028 Fix CVE(s): CVE-2023-42795

SECURITY UPDATE: Incomplete Cleanup vulnerability in Tomcat - debian/patches/CVE-2023-42795.patch: Improve handling of failures during recycle methods - CVE-2023-42795...

CLSA-2025-1740479778 python3.11: Fix of CVE-2023-6597

CVE-2023-6597: fix symlink dereferencing in TemporaryDirectory cleanup process...

CLSA-2025-1736470237 Fix of 32 CVEs

CVE-url: https://ubuntu.com/security/CVE-2021-47466 - mm, slub: fix potential memoryleak in kmemcacheopen CVE-url: https://ubuntu.com/security/CVE-2024-36968 - Bluetooth: L2CAP: Fix div-by-zero in l2capleflowctlinit Bionic update: upstream stable patchset 2021-06-23 LP: 1933375 // CVE- url:...

CLSA-2024-1734708244 Fix of 15 CVEs

OpenJDK 11.0.25 release, build 9. - CVE-2024-21131, CVE-2024-21138, CVE-2024-21140, CVE-2024-21144, CVE-2024-21145, CVE-2024-21147, CVE-2024-21208, CVE-2024-21210, CVE-2024-21217, CVE-2024-21235. - Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-October/038512.html -...

CLSA-2024-1734532058 unbound: Fix of 2 CVEs

CVE-2023-50387: Evaluate DNSSEC responses to prevent KeyTrap denial of service issue. - CVE-2023-50868: Fix Closest Encloser Proof aspect to prevent CPU consumption for SHA-1 computations in random subdomain attacks...

CLSA-2024-1733483945 Fix of 9 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-49992 - drm: remove all control node code - drm: add managed resources tied to drmdevice - drm: Set finalkfree in drmdevalloc - drm/plane: add drmmuniversalplanealloc - drm: Handle dev-unique with drmm - drm: Use drmm for drmdevinit cleanup - drm:...

CLSA-2024-1731956848 ImageMagick: Fix of 3 CVEs

CVE-2020-27751: fix shift exponent that is too large for 64-bit type at magick/quantum-export.c - CVE-2020-27757: fix outside the range of representable values of type 'unsigned long long' bug at magick/quantum-private.h - CVE-2020-27768: fix outside the range of representable values of type...

CLSA-2024-1731603213 Fix of 76 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-44946 - kcm: Serialise kcmsendmsg for the same socket. CVE-url: https://ubuntu.com/security/CVE-2024-42292 - kobjectuevent: Fix OOB access within zapmodaliasenv CVE-url: https://ubuntu.com/security/CVE-2024-41042 - netfilter: nftables: prefer...

CLSA-2024-1731344359 Fix CVE(s): CVE-2020-27763

SECURITY UPDATE: Division by zero vulnerability - debian/patches/CVE-2020-27763.patch: Fix window function scaling in resize.c to avoid division on every filter call - CVE-2020-27763...

CLSA-2024-1730915716 Update of nss

update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "OISTE WISeKey Global Root GC CA" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma Chambers of...

CLSA-2024-1730910207 Update of ca-certificates

update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "GLOBALTRUST 2020" - Certificate "OISTE WISeKey Global Root GC CA" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma Chambers of Commerce Root" - Certificate "Chambers of...

CLSA-2024-1729015920 linux-firmware: Fix of CVE-2023-31315

Update AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A10F12ver:0x0A101248, cpuid:0x00AA0F02ver:0x0AA00215, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A10F11ver:0x0A101148, cpuid:0x00A00F11ver:0x0A0011D5; - Update AMD CPU microcode for processor family 0x17:...

CLSA-2024-1728071619 python: Fix of 2 CVEs

CVE-2024-7592: fix algorithm with quadratic complexity to avoid using excess CPU resources while parsing the cookie value - CVE-2024-6232: fix regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing and was vulnerable to ReDoS via specifically-crafted tar...

CLSA-2024-1727373881 gnutls: Fix of CVE-2024-28835

CVE-2024-28835: fix crash when verifying a certificate chain with more than 16 certificates...

CLSA-2024-1726841419 bind: Fix of 2 CVEs

CVE-2024-1737-1: introduced new configurable limits that prevent the loading into zones or into cache of DNS resource records RRs that exceed them - CVE-2024-1737-2: add environment variable DNSRDATASETMAXRECORDS, DNSRBTDBMAXRTYPES to override hardcoded limits DDNSRDATASETMAXRECORDS and...

CLSA-2024-1726608591 expat: Fix of 3 CVEs

CVE-2024-45490: Reject negative length for XMLParseBuffer in xmlparse.c - CVE-2024-45491: Detect integer overflow in dtdCopy on 32-bit platforms - CVE-2024-45492: Detect integer overflow in nextScaffoldPart on 32-bit platforms...

CLSA-2024-1725012024 Fix CVE(s): CVE-2024-38477

SECURITY UPDATE: null pointer dereference in modproxy - debian/patches/CVE-2024-38477.patch: prevent crash resulting in Denial of Service in modproxy via a malicious request - CVE-2024-38477...

CLSA-2024-1724259788 java-1.8.0-openjdk: Fix of 6 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u422-b05. That fixes following CVEs: - CVE-2024-21131: UTF8 size overflow - CVE-2024-21138: Infinite loop vunlerability in SymbolTable - CVE-2024-21140: Int overflow/underflow in Range Check Elimination RCE - CVE-2024-21144: Invalid header...

CLSA-2024-1723482251 python2: Fix of CVE-2024-0450

CVE-2024-0450: add detection of "quoted-overlap" zip-bombs in zipfile module...

CLSA-2024-1722003981 httpd: Fix of 5 CVEs

CVE-2024-38474: modrewrite: server weakness with encoded question marks in backreferences - CVE-2024-38475: modrewrite: server weakness in modrewrite when first segment of substitution matches filesystem path - CVE-2024-38477: modproxy: crash resulting in Denial of Service in modproxy via a...

CLSA-2024-1721206783 freerdp: Fix of 12 CVEs

CVE-2023-39352: add bound check in gdiSolidFill - CVE-2023-39353: check indices are within range - CVE-2023-39356: fix checks for multi opaque rect - CVE-2023-40181: fix cBitsRemaining calculation - CVE-2023-40186: fix integer multiplications - CVE-2023-40188: fix input length validation -...

CLSA-2024-1720093829 openssh: Fix of CVE-2024-6387

CVE-2024-6387: the signal handler race condition itself fixed by commenting out the async-signal-unsafe code from the sshsigdie function...

CLSA-2024-1719568307 Fix of 6 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-2201 - x86/cpufeatures: Add new word for scattered features - x86/cpufeatures: Add CPUIDLNX5 to track recently added Linux-defined word - x86/bugs: Change commas to semicolons in 'spectrev2' sysfs file - x86/bhi: Add support for clearing branch histor...

CLSA-2024-1718796706 openssh: Fix of CVE-2023-48795

CVE-2023-48795: implement "strict key exchange" in ssh and sshd...

CLSA-2024-1718794810 glibc: Fix of 3 CVEs

CVE-2024-33600: nscd: avoid null pointer crashes after notfound response - CVE-2024-33601: fix memory allocation issue in netgroup cache by replacing xmalloc and xrealloc functions to prevent denial of service - CVE-2024-33602: fix memory corruption in netgroup cache by ensuring all strings are...

CLSA-2024-1717694505 glibc: Fix of 2 CVEs

CVE-2018-11236: fix stack buffer overflow when realpath input length is close to SSIZEMAX. - CVE-2024-2961: fix out-of-bound writes in ISO-2022-CN-EXT escape sequences...

CLSA-2024-1716915132 httpd: Fix of CVE-2024-27316

CVE-2024-27316: fix HTTP/2 DoS vulnerability caused by memory exhaustion from endless continuation frames: Incoming headers that exceed limits are buffered in nghttp2 to generate an HTTP 413 response...

CLSA-2024-1713333661 Fix CVE(s): CVE-2024-2398

SECURITY UPDATE: - debian/patches/CVE-2024-2398.patch: http2: push headers better cleanup provide common cleanup method for push headers - CVE-2024-2398...

CLSA-2024-1710436524 Fix CVE(s): CVE-2024-22667

SECURITY UPDATE: stack-buffer-overflow in option callback func - debian/patches/CVE-2024-22667.patch: pass size of errbuf down the call stack, use snprintf instead of sprintf - CVE-2024-22667...

CLSA-2024-1709562468 Fix CVE(s): CVE-2023-6004, CVE-2023-6918

SECURITY UPDATE: ProxyCommand/ProxyJump features allow injection of malicious code through hostname - debian/patches/CVE-2023-6004-pre1.patch: move common parser functions to configparser.c - debian/patches/CVE-2023-6004-pre2.patch: prevent possible segmentation fault -...

CLSA-2024-1708029490 gnutls: Fix of 3 CVEs

Add CVE-2024-0567 PoC test - Remove src.rpm from sources - CVE-2023-5981: removes branching that depends on secret data to prevent potential side-channel attack - CVE-2024-0553: minimize branching after decryption...

CLSA-2024-1708025673 Update of alt-php

New microcode update packages from AMD upstream up to 2023-12-05: + Update Microcode for 19h family: sig 0x00a10f12, sig 0x00a10f11, sig 0x00aa0f02; + Update Microcode for 17h family: sig 0x00830f10;...

CLSA-2024-1707379599 Update of alt-php

Update ca-certificates database to 20231207: - mozilla/certdata.txt,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.64. - The following certificates authorities were added: Certificate "Atos TrustedRoot Root CA ECC G2 2020" Certificate "Atos TrustedRoot Root CA ECC TLS 202...

CLSA-2024-1705941268 Update of ca-certificates

update to CKBI 2.64 from NSS 3.95 - updated: - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed old certificates: - Certificate "E-Tugra Certification Authority" - Certificate "Hongkong Post Root CA 1" - Certificate "Symantec Class 1 Public Primary Certification...

CLSA-2024-1705078162 Fix of 6 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-7192 - netfilter: ctnetlink: fix possible refcount leak in ctnetlinkcreateconntrack CVE-url: https://ubuntu.com/security/CVE-2023-6610 - smb: client: fix potential OOB in smb2dumpdetail CVE-url: https://ubuntu.com/security/CVE-2023-6606 - smb: client:...

CLSA-2023-1703008559 Fix CVE(s): CVE-2023-45539

SECURITY UPDATE: Accepting '' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact - debian/patches/CVE-2023-45539.patch: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header -...

CLSA-2023-1697744683 Fix of 8 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-42755 - net/sched: Retire rsvp classifier CVE-url: https://ubuntu.com/security/CVE-2023-39194 - net: xfrm: Fix xfrmaddressfilter OOB read CVE-url: https://ubuntu.com/security/CVE-2023-39192 - netfilter: xtu32: validate user space input CVE-url:...