10560 matches found
CLSA-2025-1744631408 php: Fix of CVE-2024-11235
CVE-2024-11235: fix Use-after-free for ??= due to incorrect live-range calculation...
CLSA-2025-1744628407 dnsmasq: Fix of CVE-2023-28450
CVE-2023-28450: Set the default maximum DNS UDP packet size to 1232...
CLSA-2025-1744303053 Update of nettle
Rebuild in new side-tag...
CLSA-2025-1744291208 Update of nss
Fix ecc DER wrapping...
CLSA-2025-1744116383 libtiff: Fix of 4 CVEs
CVE-2024-7006: check return value of TIFFCreateAnonField to avoid potential DoS via memory allocation failures - CVE-2023-6228: validate input image codec in tiffcp to prevent heap-based buffer overflow and potential application crash - CVE-2022-40090: improve IFD loop handling in...
CLSA-2025-1743675538 kernel: Fix of 2 CVEs
drm: nv04: Fix out of bounds access CVE-2024-27008 - media: uvcvideo: Fix double free in error path CVE-2024-57980...
CLSA-2025-1743071343 tigervnc: Fix of CVE-2025-26601
CVE-2025-26601: xorg-x11-server: fix use-after-free issue by adding check to ensure new sync object is added before alarm triggers...
CLSA-2025-1742733084 tomcat: Fix of CVE-2025-24813
CVE-2025-24813: Fix path equivalence vulnerability to prevent remote code execution and information disclosure in Default Servlet...
CLSA-2025-1742577756 libxml2: Fix of CVE-2022-49043
CVE-2022-49043: fix use-after-free vulnerability in xmlXIncludeAddNode...
CLSA-2025-1742474086 bind: Fix of CVE-2022-3094
CVE-2022-3094: fix resources exhaustion issue caused by flood of dynamic DNS updates...
CLSA-2025-1742472067 Fix CVE(s): CVE-2025-26465
SECURITY UPDATE: it's possible machine-in-the-middle attack vulnerability caused by a malicious machine impersonating a legitimate server - debian/patches/CVE-2025-26465.patch: Correct error code handling - CVE-2025-26465...
CLSA-2025-1742232795 binutils: Fix of CVE-2025-0840
CVE-2025-0840: fix stack-buffer-overflow at objdump disassemblebytes...
CLSA-2025-1741637440 mysql: Fix of 23 CVEs
Update to MySQL 8.0.41 - CVEs fixed: CVE-2024-21101 CVE-2025-21559 CVE-2025-21555 CVE-2025-21546 CVE-2025-21543 CVE-2025-21540 CVE-2025-21531 CVE-2025-21529 CVE-2025-21523 CVE-2025-21522 CVE-2025-21520 CVE-2025-21519 CVE-2025-21518 CVE-2025-21505 CVE-2025-21504 CVE-2025-21503 CVE-2025-21501...
CLSA-2025-1741637055 cups: Fix of CVE-2024-47175
CVE-2024-47175: fix improper input validation in cups for PPD files...
CLSA-2025-1741636664 cups: Fix of CVE-2024-47175
CVE-2024-47175: fix improper input validation in cups for PPD files...
CLSA-2025-1741635940 python3: Fix of 2 CVEs
CVE-2024-11168: fix improper validation of bracketed hosts in urllib.parse.urlsplit and urlparse functions - CVE-2025-0938: fix incomplete algorithm of validating hosts by disallowing square brackets in domain names...
CLSA-2025-1741635876 httpd: Fix of CVE-2022-30522
CVE-2022-30522: fix possible DoS...
CLSA-2025-1741635651 cups: Fix of CVE-2024-47175
CVE-2024-47175: fix improper input validation in cups for PPD files...
CLSA-2025-1741628775 libxml2: Fix of CVE-2025-27113
CVE-2025-27113: fix compilation of explicit child axis...
CLSA-2025-1741286348 Fix of 5 CVEs
SECURITY UPDATE: buffer over-read in xmlHTMLPrintFileContext - debian/patches/CVE-2024-34459.patch: Fix buffer overread with xmllint --htmlout by adding a missing bounds check - CVE-2024-34459 SECURITY UPDATE: use-after-free vulnerability in xinclude.c - debian/patches/CVE-2022-49043.patch: Fix...
CLSA-2025-1741286016 libxml2: Fix of CVE-2025-27113
CVE-2025-27113: fix compilation of explicit child axis...
CLSA-2025-1741216108 bind: Fix of CVE-2024-11187
CVE-2024-11187: limit additional section record while queries processing to prevent CPU exhaustion...
CLSA-2025-1741215575 Fix CVE(s): CVE-2024-31068, CVE-2024-36293, CVE-2024-39279
New microcode update packages from upstream up to 2025-02-11: - New microcodes: sig 0x000a06f3, pfmask 0x01, 2024-11-22, rev 0x3000330, size 1533952 sig 0x000b0674, pfmask 0x32, 2024-09-25, rev 0x012c, size 211968 sig 0x000b06f6, pfmask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000b06f7,...
CLSA-2025-1741033614 libvirt: Fix of CVE-2024-2494
CVE-2024-2494: check for negative array lengths before allocation in remotedaemondispatch...
CLSA-2025-1740823970 bind: Fix of CVE-2024-11187
CVE-2024-11187: Limit the additional processing for large RDATA sets...
CLSA-2025-1740645619 Update of alt-php
Internal tests: - debian/testcerts/: Update the keystore files and certificates from the upstream branch 9.0.x to fix internal tests...
CLSA-2025-1740645491 python3.11: Fix of CVE-2023-27043
CVE-2023-27043: add a strict parsing mode to prevent incorrect address interpretation. By default, strict=True is enabled. If you need the legacy behavior, explicitly set strict=False when calling parseaddr or getaddresses - Additionally, strict parsing can be disabled globally by setting the...
CLSA-2025-1740132301 krb5: Fix of CVE-2024-3596
CVE-2024-3596: Generate and verify message MACs in libkrad for vulnerability in RADIUS protocol which allows attackers to forge authentication responses...
CLSA-2025-1739962899 krb5: Fix of CVE-2024-3596
CVE-2024-3596: implement support for Message-Authenticator in libkrad...
CLSA-2025-1739812360 php: Fix of CVE-2024-8929
CVE-2024-8929: fix various heap buffer over-reads for mysqlnd - Modify spec and run-tests.php to fix extension loading during testing...
CLSA-2025-1739387678 tomcat: Fix of CVE-2023-42795
CVE-2023-42795: improve handling of failures during recycle methods...
CLSA-2025-1738695944 samba: Fix of 2 CVEs
Fix CVE-2023-42669: disable the rpcecho server - Fix CVE-2022-2127: fix out-of-bounds read triggered by a malicious request...
CLSA-2025-1738632046 Fix CVE(s): CVE-2024-12086, CVE-2024-12087, CVE-2024-12088
SECURITY UPDATE: possible information leak via checksum comparison - debian/patches/CVE-2024-12086.patch: fix info leak when connecting to malicious server - CVE-2024-12086 SECURITY UPDATE: arbitraty file write via inproper symlink verification - debian/patches/CVE-2024-12087.patch: fix writing...
CLSA-2025-1738266573 samba: Fix of CVE-2023-34967
Fix CVE-2023-34967: fix type confusion vulnerability in Samba's mdssvc RPC service for Spotlight...
CLSA-2025-1738170437 hivex: Fix of CVE-2021-3622
CVE-2021-3622: fix possible stack overflow by adding the depth of recursion in the getchildren...
CLSA-2025-1738170434 Fix CVE(s): CVE-2024-12747
SECURITY UPDATE: race condition during rsync's handling of symbolic links - debian/patches/CVE-2024-12747.patch: prevent symlink race preventing a normal file from being replaced by a symlink - CVE-2024-12747 debian/rules, debian/patches/series: use series file to manage patches...
CLSA-2025-1737993483 vim: Fix of CVE-2023-0049
CVE-2023-0049: fix invalid memory access with bad 'statusline' value...
CLSA-2025-1737463274 rsync: Fix of 2 CVEs
CVE-2024-12088: fix path traversal vulnerability by properly verifying symbolic link destinations - CVE-2024-12085: fix issue with checksum length manipulation leading to uninitialized memory leak...
CLSA-2025-1737464476 rsync: Fix of CVE-2024-12085
CVE-2024-12085: prevent leak of uninitialised stack data in hashsearch...
CLSA-2025-1737153672 git: Fix of CVE-2024-32002
CVE-2024-32002: fix submodule paths to not contain symlinks...
CLSA-2025-1736856534 python3.11: Fix of CVE-2024-9287
CVE-2024-9287: Quote path names when creating virtual environments to prevent command injection in activation scripts...
CLSA-2024-1735310784 Fix CVE(s): CVE-2024-11233
SECURITY UPDATE: Out-of-bounds read in quoted-printable decoder - debian/patches/CVE-2024-11233.patch: Fix buffer handling in convert.quoted-printable-decode filter to prevent one-byte out-of-bounds read - CVE-2024-11233...
CLSA-2024-1735300164 pam: Fix of CVE-2024-10963
CVE-2024-10963: pamaccess: rework resolving of tokens as hostname...
CLSA-2024-1735130624 php: Fix of CVE-2024-8929
CVE-2024-8929: Fix leak partial content of the heap through heap buffer over-read issue...
CLSA-2024-1735128985 Fix CVE(s): CVE-2024-50602
SECURITY UPDATE: Crash in XMLResumeParser due to XMLStopParser issue - debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an unstarted parser due to XMLERRORNOTSTARTED - debian/patches/CVE-2024-50602-1.patch: Explicitly specify XMLPARSING in XMLStopParser to ensure correct parsing status...
CLSA-2024-1735122554 ntp: Fix of CVE-2020-13817
CVE-2020-13817: randomize transmit timestamp in client requests...
CLSA-2024-1735065830 Fix CVE(s): CVE-2024-11233
SECURITY UPDATE: Security vulnerability in package - debian/patches/CVE-2024-11233.patch: fix error in convert.quoted printable-decode filter certain data leading to buffer overread. Fix segfault with streams and invalid data. - CVE-2024-11233...
CLSA-2024-1734704732 Fix CVE(s): CVE-2024-11234
SECURITY UPDATE: improper sanitization of URIs leading to HTTP request smuggling - debian/patches/CVE-2024-11234.patch: Fix HTTP wrapper full URI path to disallow CR or LF characters - CVE-2024-11234...
CLSA-2024-1734643401 Fix CVE(s): CVE-2024-6923
SECURITY UPDATE: Improper quoting of newlines in email headers - debian/patches/CVE-2024-6923.patch: Fix serialization of display name in originator or destination address fields with both encoded words and special chars - CVE-2024-6923...