16939 matches found
CLSA-2023-1685629885 git: Fix of 2 CVEs
CVE-2022-24765: fix safe.directory key not being checked in setup.c - CVE-2022-29178: avoid failing dir ownership check - some unstable tests were disabled...
CLSA-2023-1684824309 Update of alt-php
Universal build for Ubuntu/Debian...
CLSA-2023-1684823891 Update of alt-php
Universal build for Ubuntu/Debian...
CLSA-2023-1684759167 Update of file
rebuild to rebrand to TuxCare ELS...
CLSA-2023-1684174025 Update of spamassassin
Rebuilt with rebrand to TuxCare ELS...
CLSA-2023-1683815086 Fix CVE(s): CVE-2023-25652, CVE-2023-29007
SECURITY UPDATE: By feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunks from the given patch - debian/patches/CVE-2023-25652.patch: removing a link instead of writing into ...
CLSA-2023-1683229770 kernel: Fix of 22 CVEs
media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-26545 - net/ulp: prevent ULP without clone op from entering the LISTEN status CVE-2023-0461 - Bluetooth: L2CAP: Fix u8 overflow CVE-2022-45934 -...
CLSA-2023-1682593947 Fix CVE(s): CVE-2023-29469, CVE-2023-28484
SECURITY UPDATE: Null dereference - debian/patches/CVE-2023-28484.patch: Fix null-pointer-deref in xmlSchemaFixupComplexType - CVE-2023-28484 SECURITY UPDATE: Fix a null pointer dereference - debian/patches/fix-null-ptr-deref.patch: use XMLSCHEMASANYTYPE instead of a null pointer - CVE-2023-28484...
CLSA-2023-1681327540 nss: Fix of CVE-2023-0767
CVE-2023-0767: nss: improve handling of unknown PKCS12 safe bag types...
CLSA-2023-1681236252 Update of microcode_ctl
Update Intel CPU microcode to microcode-20230214 release: - Addition of 06-6c-01/0x10 microcode at revision 0x1000211; - Addition of 06-8f-04/0x10 microcode at revision 0x2c000170; - Addition of 06-8f-04/0x87 microcode at revision 0x2b000181; - Addition of 06-8f-05/0x10 microcode in...
CLSA-2023-1678820588 samba: Fix of CVE-2022-38023
CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC...
CLSA-2023-1678135884 httpd: Fix of 2 CVEs
CVE-2022-37436: modproxy: HTTP response splitting - CVE-2006-20001: moddav: out-of-bounds read/write...
CLSA-2023-1677783889 tar: Fix of CVE-2022-48303
CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...
CLSA-2023-1677231280 git: Fix of 4 CVEs
CVE-2022-41903: fix out-of-bounds write caused by integer overflow - CVE-2021-40330: forbid newlines in host and path - CVE-2022-39260: reject too long command line strings - CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links...
CLSA-2023-1677096675 Fix of 5 CVEs
SECURITY UPDATE: out-of-bounds write caused by integer overflow - debian/patches/CVE-2022-41903.patch: use 'sizet' instead of 'int' to track the string lengths and so allow 2GB input sizes. - CVE-2022-41903 - t-mark-submodule-clean-test-as-known-failure.patch: mark submodule clean test as known...
CLSA-2023-1676026276 openssl: Fix of 2 CVEs
CVE-2023-0215: Fix a UAF resulting from a bug in BIOnewNDEF - CVE-2023-0286: Fix GENERALNAMEcmp for x400Address...
CLSA-2023-1676025915 openssl: Fix of 2 CVEs
CVE-2023-0215: Fix a UAF resulting from a bug in BIOnewNDEF - CVE-2023-0286: Fix GENERALNAMEcmp for x400Address...
CLSA-2023-1675986396 Update of tzdata
Upgrade to tzdata-2022g - The northern edge of the Mexican state of Chihuahua will change time zone to agree with nearby US locations on 2022-11-30. - Added a new Zone America/CiudadJuarez that splits from America/Ojinaga. - Mexico will stop observing DST except near the US border. - Chihuahua...
CLSA-2023-1675985571 sudo: Fix of CVE-2023-22809
CVE-2023-22809: do not permit editor arguments to include "--" for sudoedit - build tests have been enabled...
CLSA-2023-1675984832 java-1.8.0-openjdk: Fix of 2 CVEs
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b09. That fixes following CVEs: - CVE-2023-21830: Improper restrictions in CORBA deserialization Serialization, 8285021 - CVE-2023-21843: Soundbank URL remote loading Sound, 8293742 - Update tzdata requirement to 2022g to match JDK-8297804 -...
CLSA-2023-1675984342 sudo: Fix of CVE-2023-22809
CVE-2023-22809: do not permit editor arguments to include "--"...
CLSA-2022-1670874138 krb5: Fix of CVE-2022-42898
CVE-2022-42898: Fix integer overflows in PAC parsing - A test-suite was activated...
CLSA-2022-1670523520 libxml2: Fix of 2 CVEs
CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...
CLSA-2022-1669237735 python2: Fix of CVE-2022-45061
CVE-2022-45061: Fix quadratic time idna decoding - fix tests to be compatible with expat 2.2.5...
CLSA-2022-1669237302 xterm: Fix of CVE-2022-45063
CVE-2022-45063: improve error recovery when setting a bitmap font for the VT100 window - Add NULL pointer checks in xstrcasecmp and xstrncasecmp to help with error recovery for a missing font...
CLSA-2022-1669236630 python: Fix of CVE-2022-45061
CVE-2022-45061: Fix quadratic time idna decoding - fix tests to be compatible with expat 2.0.1-tuxcare.els...
CLSA-2022-1667495103 Update of tzdata
Upgrade to tzdata-2022c - Add a work-around for an awk bug in FreeBSD, macOS, etc - Improve tzselect with respect to intercontinental Zones - Chile transitions to DST on 2022-09-11, not 2022-09-04 - 'make install' now defaults LOCALTIME to Factory rather than GMT - More zones that are the same...
CLSA-2022-1664799239 Fix CVE(s):
Bump epoch Disable ESM notification after installation: - remove ESM hook for apt-system - remove ESM infra/apps repositories from apt sources list Automatically mark some pytest to skip if FIPS kernel is running in a disabled state they always fail in this mode...
CLSA-2022-1664476909 Fixed CVEs in bind: CVE-2022-38177, CVE-2022-38178, CVE-2022-2795
CVE-2022-2795: fix possible resolver performance degradation when processing large delegations - CVE-2022-38177: fix memory leak in ECDSA DNSSEC verification code - CVE-2022-38178: fix memory leak in EdDSA DNSSEC verification code...
CLSA-2022-1661173301 Fix CVE(s): CVE-2022-32208
SECURITY UPDATE: When curl less than 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. - debian/patches/CVE-2022-32208.patch: krb5: return error properly on decode errors - CVE-2022-32208...
CLSA-2022-1657816433 Fixed CVE-2022-29824 in libxml2
CVE-2022-29824: fix integer overflows in xmlBuf and xmlBuffer...
CLSA-2022-1655901847 Fix CVE(s): CVE-2022-2042
SECURITY UPDATE: Using uninitialized value and freed memory in spell command - debian/patches/CVE-2022-2042.patch: Initialize "attr" and check for empty line early - CVE-2022-2042...
CLSA-2022-1655842760 Fixed CVE-2019-17571 in log4j
CVE-2019-17571: Fix the deserialization of untrusted data in SocketServer that allows an attacker to remotely execute arbitrary code...
CLSA-2022-1655821067 Update of grub2
Use CloudLinux vendor cert...
CLSA-2022-1655320860 Fixed CVEs in vim: CVE-2022-1927, CVE-2022-1897
CVE-2022-1897: fix substitution which overwrites an allocated buffer - CVE-2022-1927: fix invalid cursor position after '0;' range...
CLSA-2022-1655317609 Fixed CVEs in vim: CVE-2022-1897, CVE-2022-1927
CVE-2022-1897: fix substitution which overwrites an allocated buffer - CVE-2022-1927: fix invalid cursor position after '0;' range...
CLSA-2022-1654804579 Fixed CVEs in vim: CVE-2022-0319, CVE-2022-1886, CVE-2022-1898, CVE-2022-1851
CVE-2022-0319: correct end of Visual area when entering another buffer - CVE-2022-1851: fix invalid cursor position after text formatting - CVE-2022-1886: fix access before start of text with a put command - CVE-2022-1898: fix using freed memory with 'd'...
CLSA-2022-1654106859 Fix CVE(s): CVE-2022-0391
SECURITY UPDATE: Injection attack - debian/patches/CVE-2022-0391.patch: sanitize urls in urllib.parse when it containing ASCII newline and tabs in Doc/library/urllib.parse.rst, Lib/test/testurlparse.py, Lib/urllib/parse.py. - CVE-2022-0391...
CLSA-2022-1654011190 Fix CVE(s): CVE-2022-1473, CVE-2022-1292
SECURITY UPDATE: Improper Neutralization - debian/patches/CVE-2022-1292.patch: restrict using shell to invoke openssl due to possible privilege escalation - debian/patches/CVE-2022-1473.patch: fix bug OPENSSLLHflush memory releasing leading to DoS - CVE-2022-1292 - CVE-2022-1473...
CLSA-2022-1653499822 Fix CVE(s): CVE-2022-0318
SECURITY UPDATE: Reading beyond the end of a line - debian/patches/CVE-2022-0318.patch: For block insert only use the offset for correcting the length, adjust expected output of the relevant UTF8 block insertion test - CVE-2022-0318...
CLSA-2022-1653328424 Fixed CVEs in vim: CVE-2022-1616, CVE-2022-1621, CVE-2022-1620, CVE-2022-1629, CVE-2022-1619
CVE-2022-1619: fix going before the command line start with latin1 encoding - CVE-2022-1620: fix NULL pointer dereference when using invalig regexp - CVE-2022-1621: fix to avoid adding invalid bytes with :spellgood - CVE-2022-1629: fix reading past end of line if ended with trailing backslash -...
CLSA-2022-1653004535 Fixed CVE-2018-25032 in rsync
CVE-2018-25032: Fix memory corruption when deflating if the input has many distant matches...
CLSA-2022-1652986558 Fixed CVE-2018-25032 in rsync
CVE-2018-25032: Fix memory corruption when deflating if the input has many distant matches...
CLSA-2022-1652801135 Fixed CVE-2022-1271 in gzip
CVE-2022-1271: Fix arbitrary file override with crafted file names...
CLSA-2022-1651685129 Fix CVE(s): CVE-2019-18276
SECURITY UPDATE: privilege gain via setuid - debian/patches/CVE-2019-18276.patch: replace the use of setuid and setgid when possible with setresuid and setresgid, respectively. - CVE-2019-18276...
CLSA-2022-1649172186 Update of openvpn-devel, openvpn
Rebuilt for tuxcare.els...
CLSA-2022-1648138117 Fix of CVE: CVE-2021-3999
CVE-2021-3999: fix single byte buffer overflow and overflow in getcwd...
CLSA-2022-1646915745 Fix of CVE: CVE-2021-40145
CVE-2021-40145: Fix a double free in gdImageGd2Ptr in gdgd2.c in the GD Graphics Library...