CLSA-2024-1720178532 python3: Fix of 2 CVEs

CVE-2023-6597: Prevent tempfile.TemporaryDirectory class dereference symlinks - CVE-2024-0450: Make zipfile module reject zip archives which overlap entries in the archive. Prevent “quoted-overlap” zip-bombs exploit...

CLSA-2024-1720027216 glibc: Fix of 4 CVEs

CVE-2021-3999: getcwd - Set errno to ERANGE for size == 1 - CVE-2021-35942: wordexp - handle overflow in positional parameter number - CVE-2022-23218: Buffer overflow in sunrpc svcunixcreate - CVE-2022-23219: Buffer overflow in sunrpc clntcreate for "unix"...

CLSA-2024-1719569907 Fix CVE(s): CVE-2024-2961, CVE-2024-33599

SECURITY UPDATE: Buffer overflow in iconv function when converting to ISO-2022-CN-EXT character set - debian/patches/any/CVE-2024-2961.patch: Fix out-of-bound writes in ISO-2022-CN-EXT escape sequences - CVE-2024-2961 SECURITY UPDATE: stack-based buffer overflow in netgroup cache -...

CLSA-2024-1718290223 libssh: Fix of CVE-2023-48795

CVE-2023-48795: implement "strict key exchange" mitigations, tests/pkd/pkddaemon.c: relax pthreadkill assert in pkdstop...

CLSA-2024-1718023873 glibc: Fix of 2 CVEs

CVE-2024-2961: Fix buffer overflow issue in iconv function when converting strings to ISO-2022-CN-EXT character set - CVE-2024-33599: Fix buffer overflow in netgroup cache...

CLSA-2024-1716917767 unzip: Fix of CVE-2022-0530

CVE-2022-0530: possible flaw occurance during the conversion of a wide string to a local string...

CLSA-2024-1716916085 tomcat: Fix of CVE-2021-25329

CVE-2021-25329: use consistent approach for sub-directory checking - Fix javadoc build...

CLSA-2024-1716882786 curl: Fix of CVE-2023-46218

CVE-2023-46218: fix cookie validation to prevent passing cookies to unrelated sites...

CLSA-2024-1715946971 less: Fix of CVE-2024-32487

CVE-2024-32487: filename.c: quoting mishandling...

CLSA-2024-1714728645 git: Fix of CVE-2023-23946

CVE-2023-23946: apply - fix writing behind newly created symbolic links...

CLSA-2024-1714065693 expat: Fix of CVE-2023-52425

CVE-2023-52425: fix reparsings for large token to prevent DoS...

CLSA-2024-1713790844 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-23307 - md/raid5: fix atomicity violation in raid5cachecount CVE-url: https://ubuntu.com/security/CVE-2021-46932 - Input: appletouch - initialize work before device registration CVE-url: https://ubuntu.com/security/CVE-2021-46936 - net: fix...

CLSA-2024-1711564698 Update of alt-php

New upstream 2024a version: - Kazakhstan unifies on UTC+5 beginning 2024-03-01. - Palestine springs forward a week later after Ramadan. - zic no longer pretends to support indefinite-past DST. - localtime no longer mishandles Ciudad Juárez in 2422. New upstream 2023d version: - Ittoqqortoormiit,...

CLSA-2024-1711563891 Update of tzdata

Upgrade to tzdata-2024a - Kazakhstan unifies on UTC+5 beginning 2024-03-01. - Palestine springs forward a week later after Ramadan. - localtime no longer mishandles Ciudad Juárez in 2422. - zic no longer pretends to support indefinite-past DST. - Ittoqqortoormiit, Greenland changes time zones on...

CLSA-2024-1711563462 Update of tzdata

Upgrade to tzdata-2024a - Kazakhstan unifies on UTC+5 beginning 2024-03-01. - Palestine springs forward a week later after Ramadan. - localtime no longer mishandles Ciudad Juárez in 2422. - zic no longer pretends to support indefinite-past DST. - Ittoqqortoormiit, Greenland changes time zones on...

CLSA-2024-1711492417 Fix CVE(s): CVE-2024-0985

SECURITY UPDATE: Execution of arbitrary SQL functions as the command issuer because of late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY - debian/patches/CVE-2024-0985.patch: run REFRESH MATERIALIZED VIEW CONCURRENTLY in right security context - CVE-2024-0985...

CLSA-2024-1711477070 gmp: Fix of CVE-2021-43618

CVE-2021-43618: gmp security and enhancement update...

CLSA-2024-1711036211 Update of grub2

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel...

CLSA-2024-1710854435 Fix of 6 CVEs

OpenJDK 11.0.22 release, build 7. - CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926, CVE-2024-20945, CVE-2024-20952. - Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029215.html...

CLSA-2024-1710789286 ncurses: Fix of 2 CVEs

CVE-2023-29491.patch: Mitigate vulnerability by building the packages with modified --disable-root-environ option which now limits usage of environment for setuid/setgid programs only - CVE-2021-39537.patch: Add a check for end-of-string in cvtchar to handle a malformed string in infotocap...

CLSA-2024-1709839850 Fix CVE(s): CVE-2023-5341

SECURITY UPDATE: Heap use-after-free flaw in BMP coder - debian/patches/CVE-2023-5341.patch: Check BMP file size to fix ImproperImageHeader issue caused by a provided poc - CVE-2023-5341...

CLSA-2024-1709839769 Fix CVE(s): CVE-2023-5678

SECURITY UPDATE: Denial of service could be encountered when generating excessively long DH keys or checking excessively long DH keys or parameters. - debian/patches/CVE-2023-5678.patch: Make DHcheckpubkey and DHgeneratekey safer yet. - CVE-2023-5678...

CLSA-2024-1709728814 Update of linux-firmware

Update AMD CPU microcode to 2023-12-05: - Update AMD CPU microcode for processor family 19h: sig 0x00a10f12, sig 0x00aa0f02, sig 0x00aa0f01, sig 0x00a10f11; - Update AMD CPU microcode for processor family 17h: sig 0x00830f10; - Fix adding AMD CPU microcode for processor family 19h; - Fix release...

CLSA-2024-1709563938 vim: Fix of CVE-2024-22667

CVE-2024-22667: addressing a potential stack-buffer-overflow in option processing functions...

CLSA-2024-1709203226 kernel: Fix of 7 CVEs

KVM: nSVM: avoid picking up unsupported bits from L2 in intctl CVE-2021-3653 CVE-2021-3653 - xen/netfront: fix leaking data in shared pages CVE-2022-33740 - xfs: fix up non-directory creation in SGID directories CVE-2021-4037 - netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 -...

CLSA-2024-1708427829 Fix CVE(s): CVE-2024-25062

SECURITY UPDATE: Use-after-free in xmlValidatePopElement - debian/patches/CVE-2024-25062.patch: Fix use-after-free if XML Reader with DTD validation and XInclude expansion by not expanding XIncludes when backtracking - CVE-2024-25062...

CLSA-2024-1708029694 Update of nss

Update to CKBI 2.64 from NSS 3.95 - Removed: - Certificate "E-Tugra Certification Authority" - Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" - Certificate "Hongkong Post Root CA 1" - Certificate "Symantec Class 1 Public Primary Certification Authority - G6" - Certificate "Symantec...

CLSA-2024-1708026016 Update of microcode_ctl

Update AMD CPU microcode to 2023-10-19: - Addition AMD CPU microcode for processor family 19h: sig 0x00a10f12, sig 0x00aa0f02, sig 0x00aa0f01, sig 0x00a10f11; - Update AMD CPU microcode for processor family 17h: sig 0x00830f10...

CLSA-2024-1708024614 Update of alt-php

New microcode update packages from AMD upstream up to 2023-12-05: + Update Microcode for 19h family: sig 0x00a10f12, sig 0x00a10f11, sig 0x00aa0f02; + Update Microcode for 17h family: sig 0x00830f10;...

CLSA-2023-1703611827 Fix CVE(s): CVE-2022-48564, CVE-2023-40217

SECURITY UPDATE: potential DoS attack via CPU and RAM exhaustion - debian/patches/CVE-2022-48564.patch: Improve validation of Plist files that prevent DoS when processing malformed Apple Property List files in binary format - CVE-2022-48564 SECURITY UPDATE: TLS handshake bypass -...

CLSA-2023-1702420812 microcode_ctl: Fix of CVE-2023-23583

Update Intel CPU microcode to microcode-20231114 release, addresses CVE-2023-23583 INTEL-SA-00950: - Addition of 06-ba-02/0xe0 microcode at revision 0x411c; - Addition of 06-ba-02/0xe0 microcode at revision 0x411c; - Addition of 06-ba-03/0xe0 microcode in intel-ucode/06-ba-02 at revision 0x411c;...

CLSA-2023-1702420635 microcode_ctl: Fix of CVE-2023-23583

Update Intel CPU microcode to microcode-20231114 release, addresses CVE-2023-23583 INTEL-SA-00950: - Addition of 06-ba-02/0xe0 microcode at revision 0x411c; - Addition of 06-ba-02/0xe0 microcode at revision 0x411c; - Addition of 06-ba-03/0xe0 microcode in intel-ucode/06-ba-02 at revision 0x411c;...

CLSA-2023-1701444589 openldap: Fix of CVE-2023-2953

CVE-2023-2953: added check for strdup failure, to avoid null pointer dereference...

CLSA-2023-1700593692 Fix CVE(s): CVE-2023-3446

SECURITY UPDATE: Denial of service could be encountered if a DH key or DH parameters check experience long delays. - debian/patches/CVE-2023-3446.patch: Adds check to prevent the testing of an excessively large modulus in DHcheck. - CVE-2023-3446...

CLSA-2023-1700161280 squid: Fix of 3 CVEs

CVE-2023-46846: Improve HTTP chunked encoding compliance - CVE-2023-46847: Fix stack buffer overflow when parsing Digest Authorization - CVE-2023-46848: Fix userinfo percent-encoding...

CLSA-2023-1699468875 Fix CVE(s): CVE-2022-48560

SECURITY UPDATE: posible crash in heapq with custom comparison operators - debian/patches/CVE-2022-48560.patch: disallow releasing heap items during a comparison callback - CVE-2022-48560...

CLSA-2023-1698949525 openssl: Fix of CVE-2021-3711

CVE-2021-3711: Fix an incorrect buffer size calculation leads to an overflow - Check the plaintext buffer is large enough when decrypting SM2 - Add extended tests for SM2...

CLSA-2023-1698949430 Fix CVE(s): CVE-2023-31122

SECURITY UPDATE: modmacro buffer over-read - debian/patches/CVE-2023-31122.patch: use our own strncmp function in modmacro - CVE-2023-31122...

CLSA-2023-1698945053 libgcrypt: Fix of 4 CVEs

CVE-2013-4576: Normalize the MPIs to prevent possible side-channel attacks - CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent possible side-channel attacks - CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal prevent generation of weak keys - CVE-2021-40528: Add exponent...

CLSA-2023-1698312626 glibc: Fix of CVE-2023-4911

CVE-2023-4911: Terminate if end of input is reached...

CLSA-2023-1697817694 quagga: Fix of 2 CVEs

CVE-2023-41360: don't read the first byte of ORF header if we are ahead of stream - CVE-2023-41358: do not process NLRIs if the attribute length is zero...

CLSA-2023-1697817200 quagga: Fix of 2 CVEs

CVE-2023-41360: don't read the first byte of ORF header if we are ahead of stream - CVE-2023-41358: do not process NLRIs if the attribute length is zero...

CLSA-2023-1697740212 glib2: Fix of 5 CVEs

Enable internal tests - Skip several failed tests from the check - CVE-2023-29499: Fix GVariant offset table entry size which is not checked in isnormal - CVE-2023-32611: Fix an issue where gvariantbyteswap can take a long time with some non-normal inputs - CVE-2023-32665: Fix GVariant...

CLSA-2023-1697556743 Fix CVE(s): CVE-2022-48566

SECURITY UPDATE: Constant-time-defeating optimisations issue - debian/patches/CVE-2022-48566.patch: Make comparedigest more constant-time - CVE-2022-48566...

CLSA-2023-1697465384 python2: Fix of CVE-2022-48566

CVE-2022-48566: Make comparedigest more constant-time...

CLSA-2023-1697463486 Fix CVE(s): CVE-2023-38546

SECURITY UPDATE: сookie injection with none file - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields in lib/cookie.c - CVE-2023-38546...

CLSA-2023-1696352100 glib2: Fix of CVE-2021-27218

CVE-2021-27218: gbytearray: Do not accept too large byte arrays - Enable internal tests - Skip several failed tests from the check...

CLSA-2023-1695901429 Fix of 7 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-42753 - netfilter: ipset: add the missing IPSETHASHWITHNET0 macro for ipsethashnetportnet.c CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982 - init: Provide archcpufinalizeinit - x86/cpu: Switch to archcpufinalizeinit - init: Remo...

CLSA-2023-1693986821 python3: Fix of 2 CVEs

CVE-2022-48565: Reject XML entity declarations in plist files - CVE-2022-48566: Remove possible time-affected optimization...

CLSA-2023-1693431257 Fix of 17 CVEs

Jammy update: v5.15.75 upstream stable release LP: 1996825 // CVE-url: https://ubuntu.com/security/CVE-2022-1184 - ext4: fix check for block being out of directory size Jammy update: v5.15.61 upstream stable release LP: 1990162 // CVE-url: https://ubuntu.com/security/CVE-2022-1184 - ext4: check i...