CLSA-2024-1726773445 Fix CVE(s): CVE-2024-7264

SECURITY UPDATE: Heap Buffer Overflow in ASN.1 Parser - debian/patches/CVE-2024-7264.patch: Clean up GTime2str function to handle optional fractional seconds properly. Fix GTime2str issues and add unit tests to verify correct behaviour - CVE-2024-7264...

CLSA-2024-1726769233 krb5: Fix of 2 CVEs

CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...

CLSA-2024-1726683307 bind: Fix of CVE-2024-1737

CVE-2024-1737: fix resolver caches and authoritative zone databases to prevent degraded performance when handling client queries for the same hostname...

CLSA-2024-1726314403 Update of httpd

modproxy: Fix ProxySourceAddress binding failure with AH00938...

CLSA-2024-1725882897 kernel: Fix of 4 CVEs

media: dvb-core: Fix use-after-free due on race condition at dvbnet CVE-2022-45886 - media: dvb-core: Fix use-after-free due to race condition at dvbcaen50221 CVE-2022-45919 - bonding: Fix out-of-bounds read in bondoptionarpiptargetsset CVE-2024-39487 - net: fix dstnegativeadvice race...

CLSA-2024-1725471399 bind: Fix of CVE-2024-1975

CVE-2024-1975: Remove support for SIG0 message verification...

CLSA-2024-1725471321 bind: Fix of CVE-2024-1975

CVE-2024-1975: Remove support for SIG0 message verification...

CLSA-2024-1725012440 git: Fix of 2 CVEs

CVE-2024-32004: fetch/clone: detect dubious ownership of local repositories - CVE-2024-32465: upload-pack: disable lazy-fetching by default...

CLSA-2024-1725012269 Fix CVE(s): CVE-2024-37894

SECURITY UPDATE: Memory Corruption via Out-of-bounds Write in ESI variable assignment - debian/patches/CVE-2024-37894.patch: fix incorrect type declaration in TrieNode.cc to prevent potential type conversion issues - CVE-2024-37894...

CLSA-2024-1724870691 Fix CVE(s): CVE-2023-52629, CVE-2023-52760, CVE-2024-39484, CVE-2024-39487

CVE-url: https://ubuntu.com/security/CVE-2024-39487 - bonding: Fix out-of-bounds read in bondoptionarpiptargetsset CVE-url: https://ubuntu.com/security/CVE-2023-52760 - gfs2: Fix slab-use-after-free in gfs2qddealloc CVE-url: https://ubuntu.com/security/CVE-2023-52629 - sh: push-switch: Reorder...

CLSA-2024-1724753960 Fix CVE(s): CVE-2023-52760, CVE-2024-35835, CVE-2024-39484, CVE-2024-39487

CVE-url: https://ubuntu.com/security/CVE-2024-39487 - bonding: Fix out-of-bounds read in bondoptionarpiptargetsset CVE-url: https://ubuntu.com/security/CVE-2023-52760 - gfs2: Fix slab-use-after-free in gfs2qddealloc CVE-url: https://ubuntu.com/security/CVE-2024-39484 - mmc: davinci: Don't strip...

CLSA-2024-1724434812 Fix CVE(s): CVE-2024-1737

SECURITY UPDATE: Degraded performance issue in resolver caches and authoritative zone databases - debian/patches/CVE-2024-1737-1.patch: Mark certain RRTypes as priority, limit the number of RRs in RRSets and RR types for single name - debian/patches/CVE-2024-1737-2.patch: Smarter approach that...

CLSA-2024-1724259497 libndp: Fix of CVE-2024-5564

CVE-2024-5564: validate route information option length...

CLSA-2024-1722977316 nss: Fix of CVE-2023-6135

CVE-2023-6135: fix a vulnerability in NSS involving NIST curves susceptible to the "Minerva" side-channel attack, potentially allowing private key recovery...

CLSA-2024-1722525083 glib2: Fix of 3 CVEs

CVE-2023-29499: Fix GVariant offset table entry size which is not checked in isnormal - CVE-2023-32611: Fix an issue where gvariantbyteswap can take a long time with some non-normal inputs - CVE-2023-32665: Fix GVariant deserialisation which does not match spec for non-normal data - Enable...

CLSA-2024-1721929982 Fix CVE(s): CVE-2023-39128, CVE-2023-39129, CVE-2023-39130

SECURITY UPDATE: stack buffer overflow in adadecode - debian/patches/CVE-2023-39128.patch: Fix stack buffer overflow - CVE-2023-39128 SECURITY UPDATE: stack buffer overflow - debian/patches/CVE-2023-39129.patch: Verify COFF symbol stringtab offset and fix problem with 32bit architecture build -...

CLSA-2024-1721401321 Fix CVE(s): CVE-2020-27619

SECURITY UPDATE: eval on content received via HTTP in test suite - debian/patches/CVE-2020-27619.patch: No longer call eval on content received via HTTP in the CJK codec tests - CVE-2020-27619...

CLSA-2024-1720776957 vim: Fix of 10 CVEs

CVE-2023-0054: check the return value of vimregsub - CVE-2023-0049: avoid going over the NUL at the end - CVE-2023-0288: prevent the cursor from moving to line zero - CVE-2023-0433: check for not going over the end of the line - CVE-2023-2610: limit the text length to MAXCOL - CVE-2023-4750:...

CLSA-2024-1720772189 python2: Fix of CVE-2024-0450

CVE-2024-0450: Make zipfile module reject zip archives which overlap entries in the archive. Prevent “quoted-overlap” zip-bombs exploit...

CLSA-2024-1720548714 python3: Fix of CVE-2023-6597

CVE-2023-6597: prevent tempfile.TemporaryDirectory class dereference symlinks...

CLSA-2024-1720178308 Update of alt-php

SECURITY UPDATE: New microcode data file 2024-05-14 - New microcodes: sig 0x000a06a4, pfmask 0xe6, 2024-01-03, rev 0x001c, size 136192 sig 0x000b06a8, pfmask 0xe0, 2023-12-07, rev 0x4121, size 220160 sig 0x000c06f1, pfmask 0x87, 2024-02-05, rev 0x21000230, size 552960 sig 0x000c06f2, pfmask 0x87,...

CLSA-2024-1720026957 openssl: Fix of 2 CVEs

CVE-2023-0215: biondef: fix a UAF resulting from a bug in BIOnewNDEF - CVE-2023-0464: x509v3: Limit X.509 certificate tree size to avoid exponential use of computational resources...

CLSA-2024-1719943814 curl: Fix of 2 CVEs

CVE-2023-27538: url: fix the SSH connection reuse check - CVE-2023-27536: url: only reuse connections with same GSS delegation...

CLSA-2024-1719920294 glibc: Fix of 2 CVEs

Fix a memory leak in converthostenttogaihaddrtuple function with AIALL - CVE-2023-4806: fix memory access issue in getaddrinfo function by implementing nssgethostbyname3r hook - CVE-2023-4813: fix memory leakage in gaihinet function to prevent application crash when getaddrinfo function is called...

CLSA-2024-1719569607 Update of linux-firmware

Update AMD CPU microcode to 2024-01-16: - Update AMD CPU microcode for processor family 19h: sig 0x00a00f11, sig 0x00a00f12;...

CLSA-2024-1718903513 cups: Fix of 2 CVEs

CVE-2023-32360: require authentication for CUPS-Get-Document. - CVE-2023-32324: fix cupsstrlcpy to exit immediately if a length of the source string is zero...

CLSA-2024-1718903288 cups: Fix of 2 CVEs

CVE-2023-32360: require authentication for CUPS-Get-Document. - CVE-2023-32324: fix cupsstrlcpy to exit immediately if a length of the source string is zero...

CLSA-2024-1718900452 linux-firmware: Fix of CVE-2022-38076

Update iwlwifi firmware to mitigate CVE-2022-38076 for wifi adapters: Intel Wireless-AC 9560, Intel Wireless-AC 9462, Intel Wireless-AC 9461...

CLSA-2024-1718898112 glibc: Fix of 3 CVEs

CVE-2024-33600: nscd: avoid null pointer crashes after notfound response - CVE-2024-33601: fix memory allocation issue in netgroup cache by replacing xmalloc and xrealloc functions to prevent denial of service - CVE-2024-33602: fix memory corruption in netgroup cache by ensuring all strings are...

CLSA-2024-1718796961 pam: Fix of CVE-2024-22365

CVE-2024-22365: use ODIRECTORY to prevent local DoS situations...

CLSA-2024-1718791502 openssh: Fix of CVE-2023-48795

CVE-2023-48795: implement "strict key exchange" in ssh and sshd...

CLSA-2024-1718639881 openssl: Fix of 2 CVEs

CVE-2023-5678: Fix that DHcheckpubkey and DHgeneratekey don't check large modulus - CVE-2023-3446: Fix that checking excessively long DH keys or parameters may be very slow...

CLSA-2024-1718639724 openssl: Fix of 2 CVEs

CVE-2023-5678: Fix that DHcheckpubkey and DHgeneratekey don't check large modulus - CVE-2023-3446: Fix that checking excessively long DH keys or parameters may be very slow...

CLSA-2024-1718202007 pam: Fix of CVE-2024-22365

CVE-2024-22365: pamnamespace: protectdir: use ODIRECTORY to prevent local DoS situations...

CLSA-2024-1718192341 Update of alt-php

Bump epoch Disable ESM notification after installation: - remove ESM hook for apt-system - remove ESM infra/apps repositories from apt sources list Automatically mark some pytest to skip if FIPS kernel is running in a disabled state they always fail in this mode...

CLSA-2024-1718024371 glibc: Fix of CVE-2024-2961

CVE-2024-2961: Fix buffer overflow issue in iconv function when converting strings to ISO-2022-CN-EXT character set...

CLSA-2024-1717693264 python2: Fix of CVE-2023-27043

Remove -b option, use original maintainer approach - CVE-2023-27043: reject malformed addresses in email.parseaddr...

CLSA-2024-1717691179 file: Fix of CVE-2022-48554

CVE-2022-48554: fix stack-based buffer over-read in filecopystr in funcs.c...

CLSA-2024-1716272110 ncurses: Fix of CVE-2023-50495

CVE-2023-50495: check return value of ncsavestr from upstream patch 20230424, add validity checks in ncparseentry from upstream patch 20170826...

CLSA-2024-1716272273 less: Fix of CVE-2022-48624

CVE-2022-48624: filename.c: shell-quote filenames when invoking LESSCLOSE...

CLSA-2024-1716270655 Fix of 48 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-47233 - wifi: brcmfmac: Fix use-after-free bug in brcmfcfg80211detach CVE-url: https://ubuntu.com/security/CVE-2023-52601 - jfs: Fix memleak in dbAdjCtl CVE-url: https://ubuntu.com/security/CVE-2024-26801 - Bluetooth: Avoid potential use-after-free in...

CLSA-2024-1715280815 nginx: Fix of CVE-2023-44487

CVE-2023-44487: HTTP/2: per-iteration stream handling limit...

CLSA-2024-1714065693 expat: Fix of CVE-2023-52425

CVE-2023-52425: fix reparsings for large token to prevent DoS...

CLSA-2024-1713791075 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-23307 - md/raid5: fix atomicity violation in raid5cachecount CVE-url: https://ubuntu.com/security/CVE-2021-46932 - Input: appletouch - initialize work before device registration CVE-url: https://ubuntu.com/security/CVE-2021-46936 - net: fix...

CLSA-2024-1713370315 sudo: Fix of CVE-2023-42465

CVE-2023-42465: Make sudo less vulnerable to ROWHAMMER attacks...

CLSA-2024-1712837970 Update of microcode_ctl

Moved tuxcare patches from 2:2.1-73.16.tuxcare.els1 - genupdate2.py was updated to output strings having restricted length - Update Intel CPU microcode to microcode-20231114 release it's the same as microcode-20231009 - Update vendor patches...

CLSA-2024-1711563754 Update of tzdata

Upgrade to tzdata-2024a - Kazakhstan unifies on UTC+5 beginning 2024-03-01. - Palestine springs forward a week later after Ramadan. - localtime no longer mishandles Ciudad Juárez in 2422. - zic no longer pretends to support indefinite-past DST. - Ittoqqortoormiit, Greenland changes time zones on...

CLSA-2024-1711036211 Update of grub2

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel...

CLSA-2024-1710854435 Fix of 6 CVEs

OpenJDK 11.0.22 release, build 7. - CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926, CVE-2024-20945, CVE-2024-20952. - Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029215.html...

CLSA-2024-1710437162 bind: Fix of 2 CVEs

CVE-2023-50387: Resolved CPU exhaustion from specially crafted DNSSEC-signed zone responses - CVE-2023-50868: Resolved CPU exhaustion from DNSSEC-signed zones using NSEC3 - Enable internal tests by default...