CLSA-2025-1738695944 samba: Fix of 2 CVEs

Fix CVE-2023-42669: disable the rpcecho server - Fix CVE-2022-2127: fix out-of-bounds read triggered by a malicious request...

CLSA-2025-1738632046 Fix CVE(s): CVE-2024-12086, CVE-2024-12087, CVE-2024-12088

SECURITY UPDATE: possible information leak via checksum comparison - debian/patches/CVE-2024-12086.patch: fix info leak when connecting to malicious server - CVE-2024-12086 SECURITY UPDATE: arbitraty file write via inproper symlink verification - debian/patches/CVE-2024-12087.patch: fix writing...

CLSA-2025-1738266573 samba: Fix of CVE-2023-34967

Fix CVE-2023-34967: fix type confusion vulnerability in Samba's mdssvc RPC service for Spotlight...

CLSA-2025-1738170437 hivex: Fix of CVE-2021-3622

CVE-2021-3622: fix possible stack overflow by adding the depth of recursion in the getchildren...

CLSA-2025-1738170434 Fix CVE(s): CVE-2024-12747

SECURITY UPDATE: race condition during rsync's handling of symbolic links - debian/patches/CVE-2024-12747.patch: prevent symlink race preventing a normal file from being replaced by a symlink - CVE-2024-12747 debian/rules, debian/patches/series: use series file to manage patches...

CLSA-2025-1737993483 vim: Fix of CVE-2023-0049

CVE-2023-0049: fix invalid memory access with bad 'statusline' value...

CLSA-2025-1737463274 rsync: Fix of 2 CVEs

CVE-2024-12088: fix path traversal vulnerability by properly verifying symbolic link destinations - CVE-2024-12085: fix issue with checksum length manipulation leading to uninitialized memory leak...

CLSA-2025-1737464476 rsync: Fix of CVE-2024-12085

CVE-2024-12085: prevent leak of uninitialised stack data in hashsearch...

CLSA-2025-1737153672 git: Fix of CVE-2024-32002

CVE-2024-32002: fix submodule paths to not contain symlinks...

CLSA-2025-1736856534 python3.11: Fix of CVE-2024-9287

CVE-2024-9287: Quote path names when creating virtual environments to prevent command injection in activation scripts...

CLSA-2024-1735310784 Fix CVE(s): CVE-2024-11233

SECURITY UPDATE: Out-of-bounds read in quoted-printable decoder - debian/patches/CVE-2024-11233.patch: Fix buffer handling in convert.quoted-printable-decode filter to prevent one-byte out-of-bounds read - CVE-2024-11233...

CLSA-2024-1735300164 pam: Fix of CVE-2024-10963

CVE-2024-10963: pamaccess: rework resolving of tokens as hostname...

CLSA-2024-1735130624 php: Fix of CVE-2024-8929

CVE-2024-8929: Fix leak partial content of the heap through heap buffer over-read issue...

CLSA-2024-1735128985 Fix CVE(s): CVE-2024-50602

SECURITY UPDATE: Crash in XMLResumeParser due to XMLStopParser issue - debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an unstarted parser due to XMLERRORNOTSTARTED - debian/patches/CVE-2024-50602-1.patch: Explicitly specify XMLPARSING in XMLStopParser to ensure correct parsing status...

CLSA-2024-1735122554 ntp: Fix of CVE-2020-13817

CVE-2020-13817: randomize transmit timestamp in client requests...

CLSA-2024-1735065830 Fix CVE(s): CVE-2024-11233

SECURITY UPDATE: Security vulnerability in package - debian/patches/CVE-2024-11233.patch: fix error in convert.quoted printable-decode filter certain data leading to buffer overread. Fix segfault with streams and invalid data. - CVE-2024-11233...

CLSA-2024-1734704732 Fix CVE(s): CVE-2024-11234

SECURITY UPDATE: improper sanitization of URIs leading to HTTP request smuggling - debian/patches/CVE-2024-11234.patch: Fix HTTP wrapper full URI path to disallow CR or LF characters - CVE-2024-11234...

CLSA-2024-1734643401 Fix CVE(s): CVE-2024-6923

SECURITY UPDATE: Improper quoting of newlines in email headers - debian/patches/CVE-2024-6923.patch: Fix serialization of display name in originator or destination address fields with both encoded words and special chars - CVE-2024-6923...

CLSA-2024-1734543983 php: Fix of CVE-2024-11233

CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode filter...

CLSA-2024-1734543883 python3: Fix of CVE-2024-9287

CVE-2024-9287: fix path names quoting to prevent command injection in virtual environment activation scripts...

CLSA-2024-1734039943 php: Fix of CVE-2024-11234

CVE-2024-11234: fix stream HTTP fulluri CRLF injection...

CLSA-2024-1733429722 Fix CVE(s): CVE-2024-48992

SECURITY UPDATE: Arbitrary code execution via manipulated RUBYLIB environment variable - debian/patches/CVE-2024-48992.patch: Prevent script from setting RUBYLIB environment variable to avoid LPE - CVE-2024-48992...

CLSA-2024-1733428726 wget: Fix of CVE-2024-38428

CVE-2024-38428: properly re-implement userinfo parsing rfc2396...

CLSA-2024-1733422548 Update of expat

Version was updated...

CLSA-2024-1732702046 squid: Fix of CVE-2024-45802

CVE-2024-45802: Fix DoS by a trusted server by disabling ESI...

CLSA-2024-1732701424 Fix CVE(s): CVE-2024-23672

SECURITY UPDATE: DoS via incomplete cleanup vulnerability - debian/patches/CVE-2024-23672.patch: refactor WebSocket close for suspend/resume to ensure connection closure completes - CVE-2024-23672...

CLSA-2024-1732267577 kernel: Fix of 2 CVEs

net: bridge: xmit: make sure we have at least eth header len bytes CVE-2024-38538 - SUNRPC: Fix UAF in svctcplistendataready CVE-2023-52885 - Fix: Revert "smb: client: fix use-after-free bug in cifsdebugdataprocshow" double lock...

CLSA-2024-1732194710 httpd: Fix of 2 CVEs

CVE-2023-38709: faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses - CVE-2024-24795: HTTP response splitting in multiple modules allows an attacker that can inject malicious response headers into backend applications to...

CLSA-2024-1731432257 Fix CVE(s): CVE-2024-32020

SECURITY UPDATE: When performing a local clone of a repository we end up either copying or hardlinking the source repository into the target repository. - debian/patches/CVE-2024-32020.patch: builtin/clone: refuse local clones of unsafe repositories - CVE-2024-32020...

CLSA-2024-1731344946 openssl: Fix of CVE-2024-5535

CVE-2024-5535: Validate provided client list in ssl/ssllib.c. Clarify SSLselectnextproto documentation...

CLSA-2024-1731001050 Update of nss

update to CKBI 2.70 from NSS 3.104 - updated certificates: - Certificate "GLOBALTRUST 2020" - Certificate "certSIGN ROOT CA" - Certificate "ACCVRAIZ1" - Certificate "OISTE WISeKey Global Root GC CA" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma...

CLSA-2024-1730919636 Fix CVE(s): CVE-2024-32021

SECURITY UPDATE: Race condition when hardlinking file from the source repository into the destination file in the target repository. - debian/patches/CVE-2024-32021.patch: builtin/clone: abort when hardlinked source and target file differ - CVE-2024-32021...

CLSA-2024-1730910356 Update of nss

update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "OISTE WISeKey Global Root GC CA" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma Chambers of...

CLSA-2024-1730801437 openssl: Fix of CVE-2024-5535

CVE-2024-5535: Validate provided client list in ssl/ssllib.c. Clarify SSLselectnextproto documentation...

CLSA-2024-1730370797 Update of microcode_ctl

Update Intel CPU microcode to 20240813: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000390; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b0005c0; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

CLSA-2024-1730296987 Update of krb5

Modify the spec file not to skip the %check section during the build...

CLSA-2024-1730226852 php: Fix of CVE-2024-8925

CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

CLSA-2024-1729627400 Fix CVE(s): CVE-2023-27043

SECURITY UPDATE: Incorrect parsing of email addresses containing special characters - debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses and parseaddr functions - debian/patches/fix-urllib2-test.patch: Fix error in...

CLSA-2024-1729513208 unbound: Fix of CVE-2023-50868

CVE-2023-50868: avoid availabiluty of the remote attackers to cause a denial of service using DNSSEC...

CLSA-2024-1729193618 Fix CVE(s): CVE-2024-43802

SECURITY UPDATE: prevent heap-buffer overflow in typeahead buffer flushing - debian/patches/CVE-2024-43802.patch: fix heap-buffer-overflow in instypebuf by validating enough space left when flushing typeahead buffer - CVE-2024-43802...

CLSA-2024-1728580597 python3: Fix of 2 CVEs

CVE-2024-6232: remove backtracking when parsing tarfile headers - CVE-2024-7592: fix quadratic complexity in parsing '-quoted' cookie values with backslashes...

CLSA-2024-1728298943 kernel: Fix of 13 CVEs

btrfs: fix use-after-free after failure to create a snapshot CVE-2022-48733 - hwmon: nct6775-core Fix underflows seen when writing limit attributes CVE-2024-46757 - wifi: mac80211: Avoid address calculations via out of bounds array indexing CVE-2024-41071 - netfilter: conntrack: dccp: copy entire...

CLSA-2024-1728071284 python: Fix of 2 CVEs

CVE-2024-7592: fix algorithm with quadratic complexity to avoid using excess CPU resources while parsing the cookie value - CVE-2024-6232: fix regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing and was vulnerable to ReDoS via specifically-crafted tar...

CLSA-2024-1727895277 Fix CVE(s): CVE-2024-6232, CVE-2024-7592

SECURITY UPDATE: Excessive CPU resources usage while parsing cookies with backslashes in value - debian/patches/CVE-2024-7592.patch: Fix quadratic complexity in parsing cookie values with backslashes - CVE-2024-7592 SECURITY UPDATE: Regular expressions that allowed excessive backtracking during...

CLSA-2024-1727895152 php: Fix of 3 CVEs

CVE-2020-7071: fix URL validation with functions like filtervar$url, FILTERVALIDATEURL - CVE-2021-21705: fix URL validation functionality via filtervar function with FILTERVALIDATEURL parameter when an URL with invalid password field can be accepted as valid - CVE-2024-5458: fix early-out for...

CLSA-2024-1727453123 Fix CVE(s): CVE-2024-7348

SECURITY UPDATE: TOCTOU race condition in pgdump - debian/patches/CVE-2024-7348.patch: Fix TOCTOU race condition in pgdump. - CVE-2024-7348...

CLSA-2024-1727374287 python3.9: Fix of CVE-2024-4032

CVE-2024-4032: fix missing and incorrect ip address ranges in privatenetwork variables...

CLSA-2024-1727287657 Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371

SECURITY UPDATE: fix GSS vulnerabilities - debian/patches/CVE-2021-37370.patch: prevent modification of Extra Count field in GSS krb5 wrap CFX wrap token to avoid appearing truncated to application header - debian/patches/CVE-2021-37371.patch: fix invalid memory reads during GSS message token...

CLSA-2024-1726773445 Fix CVE(s): CVE-2024-7264

SECURITY UPDATE: Heap Buffer Overflow in ASN.1 Parser - debian/patches/CVE-2024-7264.patch: Clean up GTime2str function to handle optional fractional seconds properly. Fix GTime2str issues and add unit tests to verify correct behaviour - CVE-2024-7264...

CLSA-2024-1726769396 krb5: Fix of 2 CVEs

CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...