CLSA-2025-1759246699 python3: Fix of CVE-2025-8194

CVE-2025-8194: tarfile: validate archives to ensure non-negative member offsets...

CLSA-2025-1759223618 Update of kernel

Rebased FIPS patches to 5.14.0-570.46.1...

CLSA-2025-1758892982 php: Fix of CVE-2017-9228

CVE-2017-9228: fix heap out-of-bounds write in bitsetsetrange and parsecharclass functions...

CLSA-2025-1758705954 Fix CVE(s): CVE-2025-57807

SECURITY UPDATE: heap out-of-bounds write in BlobStream WriteBlob - debian/patches/CVE-2025-57807.patch: enforce extent ≥ offset + length when forward-seeking before writes in MagickCore/blob.c - CVE-2025-57807...

CLSA-2025-1758639838 Update of microcode_ctl

Update Intel CPU microcode to 20250812: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000401; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000643; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

CLSA-2025-1758292868 Fix CVE(s): CVE-2025-7425

SECURITY UPDATE: memory corruption vulnerability in attribute type flags - debian/patches/CVE-2025-7425.patch: Fix heap-use-after-free caused by atype corruption - CVE-2025-7425...

CLSA-2025-1758228073 Fix CVE(s): CVE-2023-30630

SECURITY UPDATE: Overwrite a local file - debian/patches/CVE-2023-30630.patch: Prevent --dump-bin from overwriting local files to address privilege escalation vulnerability - CVE-2023-30630...

CLSA-2025-1758031287 httpd: Fix of 2 CVEs

CVE-2024-47252: escape user-supplied data in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to prevent HTTP desynchronisation attack...

CLSA-2025-1758031199 httpd: Fix of 2 CVEs

CVE-2024-47252: escape user-supplied data in modssl to prevent untrusted SSL/TLS clients from inserting escape characters into log files - CVE-2025-49812: remove support for TLS upgrade to prevent HTTP desynchronisation attack...

CLSA-2025-1758010124 Update of alt-php

Bump ABI 4.4.0-278...

CLSA-2025-1757947715 php: Fix of 3 CVEs

CVE-2017-9224: fix out-of-bounds read of a stack in matchat function - CVE-2017-9226: fix out-of-bounds write or read of a heap in nextstateval function - CVE-2017-9227: fix out-of-bounds read of a stack in mbcenclen function...

CLSA-2025-1756751564 webkit2gtk3: Fix of 18 CVEs

Update to 2.48.5. The following CVEs were fixed: - CVE-2025-6558: fix processing maliciously crafted web content which may lead to an unexpected Safari crash - CVE-2025-31273: fix processing maliciously crafted web content which may lead to memory corruption - CVE-2025-31278: fix processing...

CLSA-2025-1757662405 xorg-x11-server: Fix of CVE-2025-49178

CVE-2025-49178: fix request handling flaw causing potential denial of service...

CLSA-2025-1757531273 pam: Fix of CVE-2025-6020

CVE-2025-6020: fix potential privilege escalation in pamnamspace...

CLSA-2025-1757148562 Update of kernel

Rebased FIPS patches to 5.14.0-570.39.1...

CLSA-2025-1757017511 protobuf: Fix of CVE-2024-7254

CVE-2024-7254: prevent stack overflow by limiting recursion depth when parsing nested Protocol Buffers data...

CLSA-2025-1757016520 squid34: Fix of CVE-2025-54574

CVE-2025-54574: fix buffer overflow in URN handling...

CLSA-2025-1756760036 gnutls: Fix of CVE-2025-32988

CVE-2025-32988: fix double-free vulnerability when exporting othernames in SAN...

CLSA-2025-1756409662 xorg-x11-server: Fix of 8 CVEs

CVE-2025-26594: refuse to free the root cursor and keep its ref - CVE-2025-26595: fix buffer overflow in XkbVModMaskText - CVE-2025-26596: xkb: fix computation of XkbSizeKeySyms - CVE-2025-26597: xkb: fix buffer overflow in XkbChangeTypesOfKey - CVE-2025-26598: Xi: Fix barrier device search -...

CLSA-2025-1755113592 Fix CVE(s): CVE-2025-3576

SECURITY UPDATE: prevent spoofing vulnerability in GSSAPI-protected messages using RC4-HMAC-MD5 due to weaknesses in MD5 checksum design - debian/patches/CVE-2025-3576: don't issue session keys with deprecated enctypes. Updates tests. - CVE-2025-3576...

CLSA-2025-1755113204 Fix CVE(s): CVE-2025-29088

SECURITY UPDATE: denial of service issue due to incorrect memory allocations - debian/patches/CVE-2025-29088.patch: harden the SQLITEDBCONFIGLOOKASIDE interface against misuse, such as described in forum post 48f365daec Enhancements to the SQLITEDBCONFIGLOOKASIDE documentation - CVE-2025-29088...

CLSA-2025-1755008582 dmidecode: Fix of CVE-2023-30630

CVE-2023-30630: do not let --dump-bin overwrite an existing file...

CLSA-2025-1754941200 openssh: Fix of 3 CVEs

CVE-2018-20685: fix a vulnerability scp client where a malicious server could bypass intended access restrictions and modify target directory permissions via crafted filenames - CVE-2019-6109: fix scp client where a malicious server could manipulate the client's progress display output due to...

CLSA-2025-1754939966 Fix CVE(s): CVE-2025-48386

SECURITY UPDATE: security vulnerability in package - debian/patches/CVE-2025-48386.patch: fix buffer overflow in wcsncat caused by off-by-one error and length not accounted for in wcsncat calls - CVE-2025-48386...

CLSA-2025-1754552473 libxml2: Fix of CVE-2025-7425

CVE-2025-7425: fix heap-use-after-free in xmlFreeID caused by atype corruption...

CLSA-2025-1754413251 git: Fix of 2 CVEs

CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary script execution via specially crafted filenames in a repository - CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary file creation/truncation - CVE-2025-46835: fix a vulnerability in Git GUI where editing files in...

CLSA-2025-1754413156 git: Fix of 2 CVEs

CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary script execution via specially crafted filenames in a repository - CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary file creation/truncation - CVE-2025-46835: fix a vulnerability in Git GUI where editing files in...

CLSA-2025-1754411369 sqlite: Fix of CVE-2025-6965

CVE-2025-6965: reject queries with aggregate terms exceeding column limit to prevent memory corruption...

CLSA-2025-1754381806 Fix of 8 CVEs

New microcode update packages from upstream up to 2025-05-12: - New microcodes: sig 0x000a06d1, pfmask 0x20, 2025-02-07, rev 0xa0000d1, size 1635328 sig 0x000a06d1, pfmask 0x95, 2025-02-07, rev 0x10003a2, size 1664000 sig 0x000b0650, pfmask 0x80, 2025-03-18, rev 0x000a, size 136192 sig 0x000b06d1...

CLSA-2025-1753988282 avahi: Fix of CVE-2024-52616

CVE-2024-52616: initialize DNS transaction IDs randomly at each startup to prevent predictability and mitigate DNS spoofing attacks...

CLSA-2025-1753298759 kernel: Fix of 18 CVEs

udf: Fix a slab-out-of-bounds write bug in udffindentry CVE-2022-49846 - Bluetooth: hcisync: Fix queuing commands when HCIUNREGISTER is set CVE-2022-49136 - Bluetooth: Fix use after free in hcisendacl CVE-2022-49111 - NFSv4/pnfs: Fix a use-after-free bug in open CVE-2022-50072 - NFSv4: Don't hold...

CLSA-2025-1753207140 Fix CVE(s): CVE-2025-48384

SECURITY UPDATE: security vulnerability discovered - debian/patches/CVE-2025-48384.patch: quote values containing CR character in config to prevent unintentional stripping when reading - CVE-2025-48384...

CLSA-2025-1752090268 Update of tzdata

Fix incorrect tzdb.dat by harding links...

CLSA-2025-1752089153 redis: Fix of CVE-2024-31449

CVE-2024-31449: fix stack buffer overflow in bit library triggered by Lua script execution...

CLSA-2025-1752087052 Update of ca-certificates

update to CKBI 2.74 from NSS 3.110 - updated certificates: - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Entrust Root Certification Authority" - Certificate "AffirmTrust Commercial" - Certificate "AffirmTrust Networking" - Certificate "AffirmTrust Premium" - Certificate...

CLSA-2025-1751891683 glibc: Fix of CVE-2025-4802

CVE-2025-4802: fix untrusted LDLIBRARYPATH environment variable vulnerability by properly sanitizing the dynamic shared library loading...

CLSA-2025-1751133361 open-vm-tools: Fix of CVE-2025-22247

CVE-2025-22247: prevent usage of illegal characters in user names and file paths...

CLSA-2025-1750175787 kernel: Fix of 4 CVEs

media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccoreinit CVE-2022-49478 - x86/kvm: Disable kvmclock on all CPUs on shutdown CVE-2021-47110 - cifs: fix potential double free during failed mount CVE-2022-49541 - drm/amd/pm: fix double free in siparsepowertable CVE-2022-49530...

CLSA-2025-1749826078 rsync: Fix of CVE-2016-9840

CVE-2016-9840: fix improper pointer arithmetic in bundled zlib...

CLSA-2025-1749570526 Update of java-1.8.0-openjdk

Add a macro to disable portable build - Relax BuildRequires on exact portable versions for compatibility with internal build system - Include missing portable package files as sources - Disable debugsource packages for portable builds to prevent empty debugsourcefiles.list error...

CLSA-2025-1748945377 sssd: Fix of CVE-2023-3758

CVE-2023-3758: fix race condition in adgpo...

CLSA-2025-1748629141 Update of linux-firmware

Addition AMD CPU microcode for processor family 0x19: cpuid:0x00A70FC0ver:0x0A70C005, cpuid:0x00A70F52ver:0x0A705206, cpuid:0x00A00F82ver:0x0A00820C, cpuid:0x00A40F41ver:0x0A404107, cpuid:0x00A70F80ver:0x0A708007, cpuid:0x00A20F10ver:0x0A20102D, cpuid:0x00A70F41ver:0x0A704107,...

CLSA-2025-1748366748 kernel: Fix of 12 CVEs

ext4: fix OOB read when checking dotdot dir CVE-2025-37785 - iscsiibft: Fix UBSAN shift-out-of-bounds warning in ibftattrshownic CVE-2025-21993 - media: uvcvideo: Fix double free in error path CVE-2024-57980 - jffs2: Prevent rtime decompress memory corruption CVE-2024-57850 - wifi: iwlegacy:...

CLSA-2025-1748262659 Update of alt-php

New microcode update packages from upstream up to 2025-04-10: - Addition AMD CPU microcode for processor family 0x17: cpuid:0x00870F10ver:0x08701034, cpuid:0x00860F01ver:0x0860010D, cpuid:0x00860F81ver:0x08608108; - Addition AMD CPU microcode for processor family 0x19:...

CLSA-2025-1748014298 Update of alt-php

New microcode update packages from upstream up to 2025-04-10: - Addition AMD CPU microcode for processor family 0x17: cpuid:0x00870F10ver:0x08701034, cpuid:0x00860F01ver:0x0860010D, cpuid:0x00860F81ver:0x08608108; - Addition AMD CPU microcode for processor family 0x19:...

CLSA-2025-1747926654 binutils: Fix of CVE-2025-0840

CVE-2025-0840: fix stack-buffer-overflow at objdump disassemblebytes...

CLSA-2025-1747855403 squid: Fix of 6 CVEs

CVE-2021-28651: fix memory leak in RFC 2169 response parsing - CVE-2021-28652: fix broken cache manager URL parsing - CVE-2021-31806: fix memory management bug - CVE-2021-31807: fix integer overflow problem - CVE-2021-31808: fix input validation bug - CVE-2021-33620: handle more partial responses...

CLSA-2025-1747739840 Update of microcode_ctl

Update Intel CPU microcode to 20250211: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c0003e0; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000620; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

CLSA-2025-1747691270 Update of microcode_ctl

Update Intel CPU microcode to 20250211: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c0003e0; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000620; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

CLSA-2025-1747690840 php: Fix of 3 CVEs

CVE-2025-1217: fix handling of folded headers by the http stream parser - CVE-2025-1734: fix validation of http headers with missing colon - CVE-2025-1861: fix incorrect http redirect location truncation...