CLSA-2026-1774366569 Fix CVE(s): CVE-2026-3497

SECURITY UPDATE: pre-auth crash via GSSAPI key exchange - debian/patches/CVE-2026-3497.patch: replace sshpktdisconnect with sshpacketdisconnect and initialize gssbufferdesc variables in kexgssc.c, kexgsss.c. - CVE-2026-3497...

CLSA-2026-1774010101 Fix CVE(s): CVE-2026-25898, CVE-2026-25971, CVE-2026-25983

SECURITY UPDATE: out-of-bound read with negative pixel index in UIL and XPM encoders - debian/patches/CVE-2026-25898.patch: add bounds check on pixel index value returned by GetPixelIndex before using as array subscript - CVE-2026-25898 SECURITY UPDATE: heap use-after-free in MSL repage and roll...

CLSA-2026-1773924658 expat: Fix of CVE-2026-25210

Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation...

CLSA-2026-1773829377 libtiff: Fix of CVE-2025-61145

CVE-2025-61145: fix double-free and memory leak in tiffcrop, avoid dangling pointer in loadImage by clearing readptr after free...

CLSA-2026-1773772035 Fix CVE(s): CVE-2025-23048

SECURITY UPDATE: SNI validation issue in modssl - debian/patches/CVE-2025-23048.patch: update SNI validation to move the SSL compatibility check after strict SNI hostname verification in modules/ssl/sslenginekernel.c. - CVE-2025-23048...

CLSA-2026-1773684237 Update of alt-php

Update ca-certificates database to 20260305: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.84. - The following certificates were added: Certificate "TrustAsia TLS ECC Root CA" Certificate "TrustAsia TLS RSA Root CA" Certificate "SwissSign RSA TLS Roo...

CLSA-2026-1773481701 python3.9: Fix of CVE-2025-6075

CVE-2025-6075: fix quadratic complexity in os.path.expandvars...

CLSA-2026-1773310506 osbuild-composer: Fix of 4 CVEs

rebuild with newer golang version 1.25.7-1.el96.tuxcare.els1 to fix the following CVEs - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry - CVE-2025-61726: limit parsed URL query parameters to...

CLSA-2026-1773323311 python3.11: Fix of CVE-2025-6075

CVE-2025-6075: fix quadratic complexity in os.path.expandvars...

CLSA-2026-1773315820 postgresql: Fix of CVE-2026-2003

CVE-2026-2003: guard against unexpected dimensions of oidvector/int2vector...

CLSA-2026-1773308416 cups-filters: Fix of 2 CVEs

CVE-2025-64503: fix out-of-bounds write in pdftoraster filter caused by integer overflow when processing PDFs with large MediaBox values - CVE-2025-57812: fix out-of-bounds read/write in imagetoraster TIFF processing caused by incorrect buffer size calculation in cupsImageLut...

CLSA-2026-1773160910 postgresql: Fix of 3 CVEs

CVE-2026-2004: require superuser to install non-built-in selectivity estimators and harden intarray intmatchsel against wrong operator type - CVE-2026-2005: fix heap buffer overflow in pgcrypto PGP public-key decryption by validating session key length - CVE-2026-2006: fix multibyte character...

CLSA-2026-1773137055 avahi: Fix of CVE-2026-24401

CVE-2026-24401: fix uncontrolled recursion in lookuphandlecname caused by recursive CNAMEs...

CLSA-2026-1773136115 python3.9: Fix of CVE-2025-13837

CVE-2025-13837: fix a potential denial of service in plistlib GH-119343...

CLSA-2026-1773050498 Fix CVE(s): CVE-2025-10230

SECURITY UPDATE: remote command execution via unsanitized WINS hook NetBIOS name handling in Samba AD DC - debian/patches/CVE-2025-10230.patch: validate NetBIOS names in source4 WINS hook to prevent shell metacharacter injection - debian/patches/CVE-2025-10230-test.patch: add torture tests for WI...

CLSA-2026-1772810768 python3: Fix of CVE-2025-8194

CVE-2025-8194: tarfile: validate archives to ensure non-negative member offsets to prevent infinite loop and resource exhaustion...

CLSA-2026-1772576551 python: Fix of CVE-2025-8194

CVE-2025-8194: tarfile now validates archives to ensure member offsets are non-negative...

CLSA-2026-1772574256 389-ds-base: Fix of CVE-2025-14905

CVE-2025-14905: fix heap buffer overflow in schemaattrenumcallback allows Remote Code Execution and Denial of Service...

CLSA-2026-1772186153 glibc: Fix of CVE-2025-15281

CVE-2025-15281: fix wordexp with WRDEREUSE and WRDEAPPEND returning uninitialized pointers in wewordv by resetting wewordc after wordfree...

CLSA-2026-1772177379 zlib: Fix of CVE-2016-9843

CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation...

CLSA-2026-1772120065 php: Fix of CVE-2017-8923

CVE-2017-8923: fix integer overflow when concatenating strings...

CLSA-2026-1772112014 openssl: Fix of CVE-2025-66199

CVE-2025-66199: validate uncompressed certificate length to prevent large pre-decompression allocation...

CLSA-2026-1771512005 glib2: Fix of 2 CVEs

CVE-2025-14087: fix heap corruption in GLib GVariant parser by preventing integer overflows and unsafe buffer size calculations - CVE-2025-14512: fix integer overflow in escapebytestring for byte strings with many invalid characters...

CLSA-2026-1771432562 Fix CVE(s): CVE-2025-15366

SECURITY UPDATE: defect in imaplib module, when passed a user-controlled command, commands can be injected using newlines - debian/patches/CVE-2025-15366.patch: Fix command injection by rejecting commands containing control characters - CVE-2025-15366...

CLSA-2026-1771411317 Update of ca-certificates

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go Daddy Class 2 CA" - Certificate "Starfield Class...

CLSA-2026-1771413627 Update of linux-firmware

Addition AMD CPU microcode for processor family 0x1a: cpuid:0x00B00F21ver:0x0B002161, cpuid:0x00B00F81ver:0x0B008121, cpuid:0x00B10F10ver:0x0B101058, cpuid:0x00B20F40ver:0x0B204037, cpuid:0x00B40F40ver:0x0B404035, cpuid:0x00B40F41ver:0x0B404108, cpuid:0x00B60F00ver:0x0B600037,...

CLSA-2026-1771412328 glib2: Fix of CVE-2025-14087

CVE-2025-14087: fix integer overflow when parsing bytestrings...

CLSA-2026-1771011399 ImageMagick: Fix of CVE-2025-69204

CVE-2025-69204: fix integer overflow in WriteSVGImage...

CLSA-2026-1770820858 ImageMagick: Fix of CVE-2026-23876

CVE-2026-23876: fix heap buffer overflow vulnerability in the XBM image decoder ReadXBMImage...

CLSA-2026-1770820398 openssl: Fix of CVE-2025-69421

CVE-2025-69421: fix NULL dereference in PKCS12itemdecryptd2iex...

CLSA-2026-1770804474 Fix CVE(s): CVE-2025-69418, CVE-2025-69421, CVE-2026-22796

SECURITY UPDATE: The trailing 1-15 bytes of a message may be exposed incleartext on encryption and are not covered by the authentication tag,allowing an attacker to read or tamper with those bytes without detection - debian/patches/CVE-2025-69418.patch: fix OCB AES-NI/HW stream path...

CLSA-2026-1770741587 expat: Fix of CVE-2026-24515

CVE-2026-24515: fix NULL pointer dereference in XMLExternalEntityParserCreate...

CLSA-2026-1770394049 expat: Fix of CVE-2026-24515

CVE-2026-24515: fix NULL pointer dereference in XMLExternalEntityParserCreate...

CLSA-2026-1770392599 glib2: Fix of CVE-2025-13601

CVE-2025-13601: Fix heap-based buffer overflow by correcting buffer size calculation in gescapeuristring function...

CLSA-2026-1770216227 nodejs: Fix of CVE-2023-38552

CVE-2023-38552: prevent application from intercepting integrity check operation and returning forged checksum...

CLSA-2026-1770140451 nodejs: Fix of CVE-2025-23166

CVE-2025-23166: fix SignTraits::DeriveBits to properly validate user-supplied inputs to prevent crashing Node.js process...

CLSA-2026-1769774083 net-snmp: Fix of CVE-2025-68615

CVE-2025-68615: Fix buffer overflow issue in snmptrapd daemon to prevent crashes...

CLSA-2026-1770118623 java-1.8.0-openjdk: Fix of CVE-2026-21945

Update to openjdk-shenandoah-jdk8u-shenandoah-jdk8u482-b03. - CVE-2026-21945: Security component vulnerability allowing unauthenticated attacker with network access to cause hang or crash DoS...

CLSA-2026-1769693558 cups: Fix of CVE-2025-58436

CVE-2025-58436: fix issue where slow messages could delay cupsd...

CLSA-2026-1769511237 ruby: Fix of 2 CVEs

CVE-2025-61594: fix incomplete fix for CVE-2025-27221 which allowed credential leaks to persist in URI+ CVE-2025-27221: fix credential leak by correctly truncating userinfo...

CLSA-2026-1769510460 python3: Fix of CVE-2025-12084

CVE-2025-12084: optimize clearidcache function for faster performance when building nested elements with xml.dom.minidom methods like appendChild...

CLSA-2026-1769182554 gnupg2: Fix of CVE-2025-68973

CVE-2025-68973: fix memory corruption in the armor parser that leads to out-of-bounds write for malicious input...

CLSA-2026-1769092364 curl: Fix of CVE-2025-9086

CVE-2025-9086: cookie: don't treat the leading slash as trailing...

CLSA-2026-1769084959 python3.11: Fix of CVE-2025-12084

CVE-2025-12084: fix denial-of-service by removing quadratic behavior in xml.dom.minidom node ID cache clearing when building deeply nested documents...

CLSA-2026-1769021453 mariadb: Fix of CVE-2025-13699

CVE-2025-13699: fix directory traversal in mariadb-dump --tab by safely converting table and view names when generating output file paths...

CLSA-2026-1768587600 git: Fix of 2 CVEs

CVE-2025-52005: add sideband.allowControlCharacters config which gives a possibility to avoid control characters in sideband - CVE-2024-52006: fix newline confusion in credential helpers that can lead to credential exfiltration...

CLSA-2026-1768589696 ImageMagick: Fix of CVE-2025-55160

CVE-2025-55160: fix function pointer type mismatch in Clone functions...

CLSA-2026-1768580474 php: Fix of CVE-2025-14178

CVE-2025-14178: fix integer overflow in arraymerge to prevent potential denial of service when merging arrays with total elements exceeding HTMAXSIZE...

CLSA-2026-1768395101 libpng: Fix of CVE-2025-65018

CVE-2025-65018: fixed buffer overflow vulnerability in pngimagefinishread function...

CLSA-2026-1768224866 Fix CVE(s): CVE-2025-58436

SECURITY UPDATE: Possible DoS attack caused by a slow client communication - debian/patches/CVE-2025-58436.patch: fix unresponsive cupsd process caused by a slow client - CVE-2025-58436...