17524 matches found
CLSA-2026-1769020780 python3.9: Fix of CVE-2025-12084
CVE-2025-12084: fix denial-of-service by removing quadratic behavior in xml.dom.minidom node ID cache clearing when building deeply nested documents...
CLSA-2026-1768989206 pki-servlet-engine: Fix of CVE-2025-55752
CVE-2025-55752: fix improper normalization in RewriteValve to prevent path traversal attacks...
CLSA-2026-1768815310 mariadb: Fix of CVE-2025-13699
timezone-test-to-cet: change the timezone to CET to fix the test failure - CVE-2025-13699: fix directory traversal in mariadb-dump --tab by safely converting table and view names when generating output file paths...
CLSA-2026-1768814484 ruby: Fix of CVE-2025-58767
CVE-2025-58767: fixed REXML to reject duplicate XML declarations and validate declaration attributes to protect from DoS...
CLSA-2026-1768570231 git: Fix of CVE-2024-32021
CVE-2024-32021: fix issue where cloning local source repository with symlinks may create hardlinks to arbitrary user-readable files in the objects/ directory...
CLSA-2026-1768555539 libsoup: Fix of CVE-2025-14523
CVE-2025-14523: reject duplicate Host headers...
CLSA-2026-1768411712 php: Fix of 2 CVEs
CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix...
CLSA-2026-1768210963 git: Fix of 2 CVEs
CVE-2025-52005: add sideband.allowControlCharacters config which gives a possibility to avoid control characters in sideband - CVE-2024-52006: fix newline confusion in credential helpers that can lead to credential exfiltration...
CLSA-2026-1768210674 Fix CVE(s): CVE-2025-58436
SECURITY UPDATE: Possible DoS attack caused by a slow client communication - debian/patches/CVE-2025-58436.patch: fix unresponsive cupsd process caused by a slow client - CVE-2025-58436...
CLSA-2025-1767001828 webkit2gtk3: Fix of 15 CVEs
Update to 2.50.3 - Fix multiple security issues that could lead to crashes, memory corruption, or information disclosure when processing malicious web content: - CVE-2025-66287 - CVE-2025-43458 - CVE-2025-43421 - CVE-2025-13947 - Includes fixes previously released in version 2.50.2: -...
CLSA-2025-1766079368 systemd: Fix of CVE-2025-4598
CVE-2025-4598: fixed race condition in systemd-coredump that exposes privileged core dump data...
CLSA-2025-1765379145 golang: Fix of CVE-2025-47906
CVE-2025-47906: fix issue where certain strings could cause executables in PATH variable to be returned by LookPath function...
CLSA-2025-1765287413 python-jinja2: Fix of CVE-2024-56326
CVE-2024-56326: fix format string vulnerability impacting users of applications which execute untrusted template...
CLSA-2025-1765214003 Update of java-1.8.0-openjdk
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u472-b08 GA...
CLSA-2025-1764868919 poppler: Fix of CVE-2025-32365
CVE-2025-32365: prevent out-of-bounds reads in JBIG2Bitmap::combine function in JBIG2Stream.cc...
CLSA-2025-1764771605 jackson-jaxrs-providers: Fix of CVE-2025-52999
Rebuilt with the CVE-2025-52999: fixed jackson-core version - Fixed build: replaced missing packages with a patch for PackageVersion...
CLSA-2025-1764688338 gstreamer1-plugins-good: Fix of CVE-2024-47537
CVE-2024-47537: qtdemux: fix integer overflow when allocating the samples table for fragmented MP4...
CLSA-2025-1764580671 pki-servlet-engine: Fix of 2 CVEs
CVE-2024-50379: fix TOCTOU vulnerability in JSP compilation to prevent RCE on case insensitive file systems - CVE-2024-38286: fix issue of resource allocation without limits or throttling vulnerability in TLS handshake process - Apply skip-common-daemon patch to remove the commons-daemon.jar copy...
CLSA-2025-1763648370 libsoup: Fix of 2 CVEs
CVE-2025-4945: fix integer overflow vulnerability in date/time parsing - CVE-2025-11021: fix out-of-bounds memory read in cookie date handling logic...
CLSA-2025-1763647564 xorg-x11-server-Xwayland: Fix of 3 CVEs
CVE-2024-0409: fix incorrect cursor private key usage in Xwayland/Xephyr that caused XSELINUX devPrivates corruption - CVE-2025-26597: fix buffer overflow in XkbChangeTypesOfKey by properly resizing key syms and actions when nGroups is zero - CVE-2025-26594: fix root cursor lifetime handling to...
CLSA-2025-1763467263 Fix CVE(s): CVE-2025-62168
SECURITY UPDATE: information disclosure via HTTP authentication credentials - debian/patches/CVE-2025-62168.patch: Fix bug causing visibility of proxy auth data to scripts by redacting credentials from error page code expansion output and mailto link generation - CVE-2025-62168...
CLSA-2025-1763371545 gdk-pixbuf2: Fix of CVE-2025-7345
CVE-2025-7345: fix heap buffer overflow during base64 encoding in gdkpixbufjpegimageloadincrement...
CLSA-2025-1763123915 udisks2: Fix of CVE-2025-8067
CVE-2025-8067: fix issue allowing unprivileged users to create loop devices by validating lower bound of index parameter in loop device handler function...
CLSA-2025-1763043157 Fix CVE(s): CVE-2025-55160
SECURITY UPDATE: UBSan function-type-mismatch - debian/patches/CVE-2025-55160.patch: Fix UBSan function-type-mismatch in cloning functions - CVE-2025-55160...
CLSA-2025-1762332910 kernel: Fix of 5 CVEs
ext4: fix possible UAF when remounting r/o a mmp-protected file system CVE-2021-47342 - ext4: fix memory leak in ext4fillsuper - net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - ALSA: usb-audio: Fix an...
CLSA-2025-1761847256 Fix CVE(s): CVE-2022-47673, CVE-2023-25584
SECURITY UPDATE: multiple vulnerabilities in vms-alpha.c parsemodule - debian/patches/CVE-2022-47673CVE-2023-25584-.patch: fix null pointer dereference in parsemodule by adding return value checking for bfdzalloc calls, fix potential out of bounds memory access in DST record parsing loop -...
CLSA-2025-1761744879 Fix CVE(s): CVE-2019-9923
SECURITY UPDATE: NULL pointer dereference - debian/patches/CVE-2019-9923.patch: fix a NULL pointer dereference when parsing certain archives that have malformed extended headers in paxdecodeheader in sparse.c - CVE-2019-9923...
CLSA-2025-1761673667 Fix CVE(s): CVE-2019-20044
SECURITY UPDATE: insecure privilege dropping vulnerability - debian/patches/CVE-2019-20044-.patch: improve error handling in setopt command, add OpenSSH-based setresuid/setresgid wrappers, simplify and secure privilege dropping logic, add comprehensive tests for PRIVILEGED option - CVE-2019-20044...
CLSA-2025-1761140674 Update of alt-php
Bump ABI 4.4.0-279...
CLSA-2025-1760648945 Update of alt-php
Bump ABI 5.4.0-222...
CLSA-2025-1760459898 Update of libndp
bump version to 1.2-10.0.1...
CLSA-2025-1760112150 nss: Fix of CVE-2020-25648
CVE-2020-25648: fix DoS in case of receiving multiple CCS messages - extended tests...
CLSA-2025-1760021660 qemu-kvm: Fix of 3 CVEs
CVE-2021-3750: fix for DMA reentrancy use-after-free - CVE-2023-2680: final fix for CVE-2021-3750 - CVE-2023-0330: fix reentrancy in LSI53c895a SCSI controller...
CLSA-2025-1760020311 Fix CVE(s): CVE-2025-9714
SECURITY UPDATE: uncontrolled recursion leading to stack overflow via crafted XPath expressions - debian/patches/CVE-2025-9714.patch: Make XPath depth check work with recursive invocations to prevent stack overflows - CVE-2025-9714...
CLSA-2025-1760019285 Fix CVE(s): CVE-2025-55212
SECURITY UPDATE: crash triggered by passing a colon to montage -geometry - debian/patches/CVE-2025-55212.patch: Fix invalid height and width checks in ThumbnailImage using MagickSafeReciprocal - CVE-2025-55212...
CLSA-2025-1759413150 openexr: Fix of CVE-2024-31047
CVE-2024-31047: fix denial of service issue in convert function of exrmultipart.cpp...
CLSA-2025-1759336419 libxml2: Fix of CVE-2025-7425
Fix typo in CVE-2025-7425 fix...
CLSA-2025-1759246699 python3: Fix of CVE-2025-8194
CVE-2025-8194: tarfile: validate archives to ensure non-negative member offsets...
CLSA-2025-1759223618 Update of kernel
Rebased FIPS patches to 5.14.0-570.46.1...
CLSA-2025-1758892982 php: Fix of CVE-2017-9228
CVE-2017-9228: fix heap out-of-bounds write in bitsetsetrange and parsecharclass functions...
CLSA-2025-1758705954 Fix CVE(s): CVE-2025-57807
SECURITY UPDATE: heap out-of-bounds write in BlobStream WriteBlob - debian/patches/CVE-2025-57807.patch: enforce extent ≥ offset + length when forward-seeking before writes in MagickCore/blob.c - CVE-2025-57807...
CLSA-2025-1758639838 Update of microcode_ctl
Update Intel CPU microcode to 20250812: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000401; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000643; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...
CLSA-2025-1758292868 Fix CVE(s): CVE-2025-7425
SECURITY UPDATE: memory corruption vulnerability in attribute type flags - debian/patches/CVE-2025-7425.patch: Fix heap-use-after-free caused by atype corruption - CVE-2025-7425...
CLSA-2025-1758228073 Fix CVE(s): CVE-2023-30630
SECURITY UPDATE: Overwrite a local file - debian/patches/CVE-2023-30630.patch: Prevent --dump-bin from overwriting local files to address privilege escalation vulnerability - CVE-2023-30630...
CLSA-2025-1758031287 httpd: Fix of 2 CVEs
CVE-2024-47252: escape user-supplied data in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to prevent HTTP desynchronisation attack...
CLSA-2025-1758031199 httpd: Fix of 2 CVEs
CVE-2024-47252: escape user-supplied data in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to prevent HTTP desynchronisation attack...
CLSA-2025-1758010124 Update of alt-php
Bump ABI 4.4.0-278...
CLSA-2025-1757947715 php: Fix of 3 CVEs
CVE-2017-9224: fix out-of-bounds read of a stack in matchat function - CVE-2017-9226: fix out-of-bounds write or read of a heap in nextstateval function - CVE-2017-9227: fix out-of-bounds read of a stack in mbcenclen function...
CLSA-2025-1756751564 webkit2gtk3: Fix of 18 CVEs
Update to 2.48.5. The following CVEs were fixed: - CVE-2025-6558: fix processing maliciously crafted web content which may lead to an unexpected Safari crash - CVE-2025-31273: fix processing maliciously crafted web content which may lead to memory corruption - CVE-2025-31278: fix processing...