CLSA-2026-1791392792 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 8 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.12...

CLSA-2026-1790305167 TuxCare security update for 123 packages (8 CVEs)

TuxCare rebuilt 123 packages to address 8 CVEs. Fixed in 11.0.33.tuxcare0001...

CLSA-2026-1779123410 jq: Fix of 8 CVEs

CVE-2026-40164: randomize hash seed to mitigate hash collision DoS - CVE-2026-40612: limit containment check depth - CVE-2026-41256: fix NUL truncation in program files loaded with -f - CVE-2026-41257: fix signed-int overflow in stackreallocate - CVE-2026-43894: cap numeric literal length to...

CLSA-2026-1778787063 kernel: Fix of 122 CVEs

net: skbuff: propagate shared-frag marker through pskbcopy - mptcp: always handle address removal under msk socket lock CVE-2025-21875 - uprobes: Reject the shared zeropage in uprobewriteopcode CVE-2025-21881 - net: hns3: make sure ptp clock is unregister and freed if hclgeptpgetcycle returns an...

CLSA-2026-1778759582 kernel: Fix of 40 CVEs

fix: "vsock: Ignore signal/timeout on connect if already established CVE-2025-40248" - gfs2: Fix possible data races in gfs2showoptions CVE-2023-53622 - ALSA: 6fire: fix use-after-free on disconnect CVE-2026-31581 - nfnetlinkosf: validate individual option lengths in fingerprints CVE-2026-23397 -...

CLSA-2026-1778068515 Fix CVE(s): CVE-2026-0966

SECURITY UPDATE: heap buffer underflow in sshgethexa on zero-length or NULL input, remotely reachable via GSSAPI authentication logging - debian/patches/CVE-2026-0966.patch: reject NULL/zero-length input in sshgethexa in src/dh.c - CVE-2026-0966: fix heap buffer underflow in sshgethexa...

CLSA-2026-1777392820 java-11-openjdk: Fix of 6 CVEs

Upgrade to openjdk-11.0.30+7 GA. The following CVEs were fixed: - CVE-2026-21945: enhance certificate checking - CVE-2026-21932: enhance handling of URIs - CVE-2026-21933: improve HttpServer request handling - CVE-2026-21925: improve JMX connections - CVE-2025-64720: update libpng to 1.6.51 -...

CLSA-2026-1777306907 runc: Fix of CVE-2026-25679

Rebuild with Go 1.25.8 to fix Go standard library CVE - CVE-2026-25679: reject invalid IPv6 host literals in net/url.Parse to prevent URL validation bypass...

CLSA-2026-1776791510 nginx: Fix of 5 CVEs

CVE-2017-7529: fix integer overflow in range filter - CVE-2018-16843: fix excessive memory consumption in HTTP/2 - CVE-2018-16844: fix excessive CPU usage in HTTP/2 - CVE-2019-9511: fix excessive memory growth via HTTP/2 DATA frame manipulation - CVE-2019-9513: fix excessive CPU usage via HTTP/2...

CLSA-2026-1775655363 kernel: Fix of 9 CVEs

ovl: Filter invalid inodes with missing lookup function CVE-2024-56570 - ALSA: aloop: Fix racy access at PCM trigger CVE-2026-23191 - media: imon: reorganize serialization CVE-2025-39993 - usb: xhci: Fix inverted ringxrunevent check in handletxevent CVE-2025-37882 - Revert "VFS: Impose ordering...

CLSA-2026-1774277303 freerdp: Fix of CVE-2026-31806

CVE-2026-31806: Fix heap buffer overflow in nscprocessmessage...

CLSA-2026-1770741856 Fix CVE(s): CVE-2026-0861

SECURITY UPDATE: reinstate alignment overflow - debian/patches/CVE-2026-0861.patch: Fix alignment overflow check regression in intmemalign caused by the PTRDIFFMAX size cap change - CVE-2026-0861...

CLSA-2025-1764151168 kernel: Fix of 39 CVEs

perf/aux: Fix AUX buffer serialization CVE-2024-46713 - block: fix uaf for flush rq while iterating tags CVE-2024-53170 - zram: fix potential UAF of zram table CVE-2025-21671 - sched: schcake: add bounds checks to host bulk flow fairness counts CVE-2025-21647 - bpf: Fix UAF via mismatching...

CLSA-2025-1758289815 Fix CVE(s): CVE-2025-53101

SECURITY UPDATE: stack overflow via multiple consecutive %d format specifiers in filename template - debian/patches/CVE-2025-53101.patch: Fix InterpretImageFilename function by adjusting the offset to prevent potential buffer overflow - CVE-2025-53101...

CLSA-2025-1747430034 Fix of 54 CVEs

Bionic update: upstream stable patchset 2022-04-13 LP: 1968932 // CVE- url: https://ubuntu.com/security/CVE-2022-23041 - xen/gnttab: fix gnttabendforeignaccess without page specified Bionic update: upstream stable patchset 2023-01-20 LP: 2003596 // CVE- url:...

CLSA-2025-1745588218 java-1.8.0-openjdk: Fix of 3 CVEs

Upgrade to shenandoah-jdk8u452-b09 fixing the following CVEs: - CVE-2025-21587: better TLS connection support - CVE-2025-30691: improve compiler transformations - CVE-2025-30698: enhance Buffered Image handling...

CLSA-2024-1728936982 kernel: Fix of 86 CVEs

drm/amd/pm: Fix negative array index read CVE-2024-46821 - drm/amd/display: Check gpioid before used as array index CVE-2024-46818 - drm/amd/display: Check linkindex before accessing dc-links CVE-2024-46813 - drm/amd/display: Fix index may exceed array range within fpuupdatebwboundingbox...

CLSA-2024-1718973794 Fix of 21 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26777 - fbdev: sis: Error out if pixclock equals zero CVE-url: https://ubuntu.com/security/CVE-2021-47542 - net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic83xxaddrings CVE-url: https://ubuntu.com/security/CVE-2021-47518 - nfc: fix...

CLSA-2024-1716980150 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26929 - scsi: qla2xxx: Fix double free of fcport CVE-url: https://ubuntu.com/security/CVE-2024-35997 - HID: i2c-hid: remove I2CHIDREADPENDING flag to prevent lock-up CVE-url: https://ubuntu.com/security/CVE-2023-52752 - smb: client: fix use-after-free...

CLSA-2024-1714727824 expat: Fix of CVE-2023-52425

CVE-2023-52425: fix reparsings for large token to prevent DoS...

CLSA-2023-1691068607 Update of ca-certificates

Update to CKBI 2.62 from NSS 3.91 - Certificate "BJCA Global Root CA1" - Certificate "BJCA Global Root CA2"...

CLSA-2023-1677095961 git: Fix of 6 CVEs

CVE-2022-41903: fix out-of-bounds write caused by integer overflow - CVE-2021-40330: forbid newlines in host and path - CVE-2022-39260: reject too long command line strings - CVE-2021-23521: implement size checks for .gitattributes - CVE-2023-22490: prevent arbitrary path exfiltration when using...

CLSA-2026-1773101685 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post5+tuxcare...

CLSA-2026-1779212122 sos: Fix of CVE-2022-2806

CVE-2022-2806: ovirt plugin: filter out all password keys in answer files...

CLSA-2026-1779184141 expat: Fix of CVE-2026-45186

CVE-2026-45186: fix quadratic complexity in attribute name collision check...

CLSA-2026-1779096552 Fix CVE(s): CVE-2025-13836, CVE-2026-4519

SECURITY UPDATE: memory denial of service via attacker-controlled Content-Length in http.client - debian/patches/CVE-2025-13836.patch: rewrite Lib/http/client.py saferead to read large responses in geometrically-growing chunks bounded by MINREADBUFSIZE 1 MiB, preventing OOM when a malicious serve...

CLSA-2026-1778859875 samba: Fix of CVE-2025-0620

Fix CVE-2025-0620: smbd doesn't pick up group membership changes when re-authenticating an expired SMB session...

CLSA-2026-1778858907 mod_proxy_cluster: Fix of 2 CVEs

CVE-2023-6710: stored XSS in modcluster-manager HTML output via virtual host and context names rendered without HTML escaping - CVE-2024-10306: unauthorized MCMP requests due to directive being ignored for protocol-handler filtering; runtime guard now refuses siblings of EnableMCPMReceive, and...

CLSA-2026-1778143159 jq: Fix of 2 CVEs

CVE-2026-33948: fix NUL truncation in JSON parser validation bypass - CVE-2026-33947: fix unbounded recursion stack overflow in jvsetpath/getpath/delpaths...

CLSA-2026-1777942724 vim: Fix of 3 CVEs

CVE-2021-3928: fix reading uninitialized memory in spell suggestions spellsuggest.c - CVE-2022-1616: fix buffer overflow in invalid command with composing chars exdocmd.c - CVE-2022-1620: fix NULL pointer dereference when using invalid pattern buffer.c...

CLSA-2026-1778107793 qt5-qtbase: Fix of 3 CVEs

CVE-2025-5455: fix qDecodeDataUrl crash on malformed data URL with charset - CVE-2024-25580: fix KTX file reading buffer overflow - CVE-2024-39936: delay HTTP/2 communication until encrypted can be responded to includes prerequisite to emit encrypted on H2 path...

CLSA-2026-1778005827 git: Fix of CVE-2025-46835

CVE-2025-46835: fix Git GUI from creating and overwriting arbitrary files when editing a file in a maliciously crafted repository directory...

CLSA-2026-1777567965 openssh: Fix of CVE-2026-35385

CVE-2026-35385: when downloading files as root in legacy -O mode and without the -p preserve modes flag, scp1 did not clear setuid/setgid bits from downloaded files. Backport upstream commit 487e8ac1 to mask out the setuid/setgid bits in this case...

CLSA-2026-1777567502 openssl: Fix of CVE-2026-28387

CVE-2026-28387: fix use-after-free / double-free in danematch by releasing the previously stored dane-mcert with X509free instead of OPENSSLfree; the slot is reference-bumped via X509upref so the matching free is X509free...

CLSA-2026-1777386823 buildah: Fix of CVE-2026-34986

CVE-2026-34986: fix go-jose panic on JWE decryption when encryptedkey field is empty...

CLSA-2026-1777301041 gd: Fix of CVE-2021-38115

Fix CVE-2021-38115: out-of-bounds read in readheadertga...

CLSA-2026-1775779453 Fix of 68 CVEs

CVE-2025-39743 - jfs: truncate good inode pages when hard link is 0 CVE-2025-39743 CVE-2025-39685 - comedi: pcl726: Prevent invalid irq number CVE-2025-39685 CVE-2025-38713 - hfsplus: fix slab-out-of-bounds read in hfsplusuni2asc CVE-2025-38713 CVE-2025-38699 - scsi: bfa: Double-free fix...

CLSA-2026-1775223681 python: Fix of CVE-2025-15367

CVE-2025-15367: reject control characters in POP3 commands to prevent command injection via newlines...

CLSA-2026-1773832495 Fix of 114 CVEs

CVE-2023-53515 - virtio-mmio: don't break lifecycle of vmdev CVE-2023-53515 CVE-2025-39967 - fbcon: fix integer overflow in fbcondosetfont CVE-2025-39967 - fbcon: Fix OOB access in font allocation CVE-2025-39967 CVE-2025-38702 - fbdev: fix potential buffer overflow in doregisterframebuffer...

CLSA-2026-1773045484 kernel: Fix of 28 CVEs

fix: dm: fix dmblkreportzones CVE-2025-38141 - ice: Fix a null pointer dereference in icecopyandinitpkg CVE-2025-38664 - qed: Don't collect too many protection override GRC elements CVE-2025-39949 - drm/amd/display: Avoid a NULL pointer dereference CVE-2025-39693 - iommu/amd/pgtbl: Fix possible...

CLSA-2026-1772039226 golang: Fix of 2 CVEs

CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing - CVE-2025-61732: prevent cgo code smuggling by removing user-controlled content from documentation strings in generated ASTs...

CLSA-2026-1771664593 Fix CVE(s): CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

OpenJDK 8u482 release + CVE-2026-21945: enhance Certificate Checking + CVE-2026-21932: enhance Handling of URIs + CVE-2026-21933: improve HttpServer Request handling + CVE-2026-21925: improve JMX connections - Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html...

CLSA-2026-1768663754 kernel: Fix of 38 CVEs

ALSA: usb-audio: Fix out-of-bounds read in sndusbgetaudioformatuac3 CVE-2025-38249 - drm/i915/gt: Fix timeline left held on VMA alloc error CVE-2025-38389 - md/raid1: Fix stack memory use after return in raid1reshape CVE-2025-38445 - atm: clip: Fix infinite recursive call of clippush...

CLSA-2026-1767949942 httpd: Fix of CVE-2025-58098

CVE-2025-58098: fix passes the shell-escaped query string to exec cmd="..." directives...

CLSA-2025-1765231763 golang: Fix of 3 CVEs

Update to Go 1.22.9 - Remove CVE-2024-34155, CVE-2024-34156, and CVE-2024-34158 patches - Remove fix-standard-crypto-panic.patch no longer needed - Add disablestatictestspart1.patch and disablestatictestspart2.patch to disable OpenSSL backend for static builds - Add...

CLSA-2025-1755112965 Fix of 5 CVEs

OpenJDK 8u462 release - CVE-2025-30749: Java 2D heap corruption, code execution/DoS - CVE-2025-30754: JSSE TLS handshake flaw, weakened encryption - CVE-2025-30761: nashorn sandbox bypass, code execution - CVE-2025-50059: HTTP client header bug, data leak - CVE-2025-50106: Glyph rendering memory...

CLSA-2025-1751038683 Update of tzdata

Upgrade to tzdata-2025b - New zone for Aysén Region in Chile which moves from -04/-03 to -03. - Paraguay adopted permanent -03 starting spring 2024. - Improve pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Improve historical data for Mexico, Mongolia, and Portugal. - System V...

CLSA-2025-1746653856 ruby: Fix of 2 CVEs

upgrade rexml version to 3.3.3 - CVE-2024-41946: fix DoS vulnerability when parsing many entity expansions with SAX2 or pull parser API - CVE-2024-41123: fix DoS vulnerability when parsing XML with specific characters...

CLSA-2025-1742471200 kernel: Fix of 19 CVEs

net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - smb: client: fix potential deadlock when releasing mids CVE-2023-52757 - tcp/dccp: Don't use timerpending in reqskqueueunlink. CVE-2024-50154 - ALSA: 6fire: Release resources at card release CVE-2024-53239 - smb: client: fix...

CLSA-2025-1739352814 kernel: Fix of 13 CVEs

media: uvcvideo: Skip parsing frames of type UVCVSUNDEFINED in uvcparseformat CVE-2024-53104 - btrfs: fix information leak in btrfsioctllogicaltoino CVE-2024-35849 - net: afcan: do not leave a dangling sk pointer in cancreate CVE-2024-56603 - netfilter: xtables: fix LED ID check in ledtgcheck...