10560 matches found
CLSA-2026-1775669856 ImageMagick: Fix of CVE-2026-25986
CVE-2026-25986: heap buffer overflow write in YUV decoder when image dimensions are not properly validated...
CLSA-2026-1775221560 exiv2: Fix of CVE-2026-27631
CVE-2026-27631: fix integer overflow in preview component of PSD image parser...
CLSA-2026-1775210281 squid: Fix of CVE-2026-32748
CVE-2026-32748: fix HttpRequest lifetime for ICP v3 queries...
CLSA-2026-1774947465 Fix CVE(s): CVE-2026-32748, CVE-2026-33515, CVE-2026-33526
SECURITY UPDATE: Denial of Service in ICP request handling via double rfc1738escape call causing heap use-after-free - debian/patches/CVE-2026-33526.patch: Remove redundant rfc1738escape call in icpGetRequest - CVE-2026-33526 SECURITY UPDATE: Denial of Service in ICP v3 query handling via...
CLSA-2026-1774614065 python3: Fix of CVE-2025-15366
CVE-2025-15366: reject control characters in IMAP commands...
CLSA-2026-1774519941 webkit2gtk3: Fix of CVE-2025-43441
CVE-2025-43441: fix macro scratch register spilling in OMG tail calls to prevent memory corruption via crafted web content...
CLSA-2026-1774438452 python3.11: Fix of 3 CVEs
CVE-2026-1299: Fix header injection; quote newlines in email headers and reject incorrectly folded LiteralHeader values during serialization with BytesGenerator. - CVE-2026-0865: Fix header injection via user-controlled header names and values containing newlines; sanitize and reject header names...
CLSA-2026-1774374355 capstone: Fix of CVE-2025-67873
CVE-2025-67873: fix heap buffer overflow in csinsn.bytes...
CLSA-2026-1774283672 Fix CVE(s): CVE-2026-25965
SECURITY UPDATE: local file disclosure through path traversal bypass of path security policy - debian/patches/CVE-2026-25965.patch: Resolve and canonicalize file paths before policy pattern matching; prevent path traversal by fixing policy checks that matched unnormalized paths including symlinks...
CLSA-2026-1774262622 ImageMagick: Fix of CVE-2026-25983
CVE-2026-25983: fix use-after-free in MSL decoder repage/roll handlers...
CLSA-2026-1774261018 python3.9: Fix of 3 CVEs
CVE-2026-0865: Prevent HTTP header injection: validate and reject user- controlled header names and values containing newlines. - CVE-2025-15367: Reject control characters in POP3 commands - CVE-2026-1299: Reject incorrectly folded LiteralHeader values and quote newlines during BytesGenerator...
CLSA-2026-1774258892 postgresql: Fix of CVE-2026-2003
CVE-2026-2003: fix improper validation of oidvector and prevent disclosure of a few bytes of server memory...
CLSA-2026-1773932358 libssh: Fix of CVE-2026-3731
Fix CVE-2026-3731: out-of-bounds read in SFTP extension name handler...
CLSA-2026-1773930717 Fix CVE(s): CVE-2026-25210
SECURITY UPDATE: integer overflow in doContent tag buffer reallocation. - debian/patches/CVE-2026-25210.patch: add overflow check for tag buffer reallocation - CVE-2026-25210...
CLSA-2026-1773930526 Fix CVE(s): CVE-2026-25210
SECURITY UPDATE: integer overflow in doContent tag buffer reallocation. - debian/patches/CVE-2026-25210.patch: add overflow check for tag buffer reallocation - CVE-2026-25210...
CLSA-2026-1773929316 Fix CVE(s): CVE-2026-3731
SECURITY UPDATE: remote out-of-bounds read in SFTP extension name handler - debian/patches/CVE-2026-3731.patch: Fix out-of-bound read from sftp extensions; correct index comparison from '' to '=' and prevent access past extension count. - CVE-2026-3731...
CLSA-2026-1773928179 expat: Fix of CVE-2026-25210
Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation...
CLSA-2026-1773830791 libssh: Fix of CVE-2026-3731
CVE-2026-3731: fix out-of-bounds read in sftpextensionsgetname and sftpextensionsgetdata when idx equals the extension count...
CLSA-2026-1773669005 compat-openssl11: Fix of CVE-2025-69419
CVE-2025-69419: fix heap buffer overflow in OPENSSLuni2utf8 via bmptoutf8...
CLSA-2026-1773505564 vim: Fix of CVE-2026-26269
CVE-2026-26269: fix stack-based buffer overflow in NetBeans integration that could lead to a crash or arbitrary code execution via a malicious server...
CLSA-2026-1773505272 python3.11: Fix of CVE-2025-6075
CVE-2025-6075: fix quadratic complexity in os.path.expandvars...
CLSA-2026-1773480954 python3.9: Fix of CVE-2025-6075
CVE-2025-6075: fix quadratic complexity in os.path.expandvars...
CLSA-2026-1773413074 Fix CVE(s): CVE-2026-24481
SECURITY UPDATE: heap information disclosure in PSD channel decoder - debian/patches/CVE-2026-24481.patch: initialize pixel buffer with zeros in ReadPSDChannelZip to prevent heap memory disclosure - CVE-2026-24481...
CLSA-2026-1773412800 Fix CVE(s): CVE-2026-25795
SECURITY UPDATE: nULL pointer dereference and crash during image read when temporary file creation fails - debian/patches/CVE-2026-25795.patch: Destroy readinfo after copying filename and avoid NULL pointer dereference in ReadSFWImage; cause: incorrect order of operations when temporary file...
CLSA-2026-1773412568 Fix CVE(s): CVE-2025-15224
SECURITY UPDATE: unexpected SSH agent authentication during public-key SSH- based transfers - debian/patches/CVE-2025-15224.patch: Require private key or SSH agent for public-key authentication; prevent attempted public-key auth when neither private key nor agent present; fix missing check that...
CLSA-2026-1773405202 curl: Fix of CVE-2025-15224
CVE-2025-15224: fix libssh public-key auth fallback to SSH agent...
CLSA-2026-1773308764 Fix CVE(s): CVE-2026-25796, CVE-2026-25798, CVE-2026-25799, CVE-2026-26066
SECURITY UPDATE: denial-of-service via division-by-zero in image loading - debian/patches/CVE-2026-25799.patch: Fix sampling-factor validation by replacing incorrect AND with OR in horizontal/vertical axis checks and prevent acceptance of invalid sampling caused by flawed boolean logic. -...
CLSA-2026-1773137907 nginx: Fix of CVE-2026-1642
CVE-2026-1642: fix upstream TLS proxy vulnerability allowing MITM inject plaintext into proxied responses; enforce strict upstream TLS verification and reject injected plaintext...
CLSA-2026-1772703383 vim: Fix of CVE-2026-26269
CVE-2026-26269: fix stack-based buffer overflow in NetBeans integration that could lead to a crash or arbitrary code execution via a malicious server...
CLSA-2026-1773051259 libtiff: Fix of CVE-2025-61143
CVE-2025-61143: fix OOB in tiffdither and fix null pointer dereference in tiffcrop...
CLSA-2026-1772814085 Fix CVE(s): CVE-2026-26269
SECURITY UPDATE: Buffer overflow in netbeans specialkeys handling - debian/patches/CVE-2026-26269.patch: limit writing to max KEYBUFLEN bytes - CVE-2026-26269...
CLSA-2026-1772813746 php: Fix of CVE-2017-9119
CVE-2017-9119: handle memory limit error during string reallocation correctly...
CLSA-2026-1772646053 python3: Fix of CVE-2025-12084
CVE-2025-12084: Prevent quadratic-time behavior when building excessively nested XML elements...
CLSA-2026-1772638779 cups-filters: Fix of CVE-2025-57812
CVE-2025-57812: fix out-of-bounds read/write when processing crafted TIFF images; validate bytes-per-pixel and use correct pixel buffer size, preventing memory access outside the buffer...
CLSA-2026-1772464109 Fix CVE(s): CVE-2026-25897, CVE-2026-26284
SECURITY UPDATE: security vulnerability CVE-2026-25897 - debian/patches/CVE-2026-25897.patch: prevent integer overflow during pixel buffer size calculation by using checked multiplication and validating rows addition; issue caused by unvalidated header values allowing overflow and incorrect...
CLSA-2026-1771956748 gimp: Fix of CVE-2025-15059
CVE-2025-15059: fix PSP file loader to validate channel types for grayscale images, preventing invalid memory access from incorrect offset computation...
CLSA-2026-1771955371 openssl: Fix of CVE-2025-69419
CVE-2025-69419: fix one-byte write-before-buffer triggered by malicious PKCS12 BMPString containing non-ASCII BMP code point; validate UTF8putc return and use correct destination capacity during conversion from UTF-16BE into UTF-8...
CLSA-2026-1771931183 python2: Fix of CVE-2025-15367
CVE-2025-15367: reject control characters in POP3 commands to prevent command injection via embedded newlines...
CLSA-2026-1771857969 Fix CVE(s): CVE-2025-14087, CVE-2025-14512
SECURITY UPDATE: Buffer underflow in GVariant parser leads to heap corruption - debian/patches/CVE-2025-1408714512.patch: Fix integer overflows in GVariant text format parser when processing input longer than INTMAX - CVE-2025-14087 SECURITY UPDATE: Integer overflow in escapebytestring leads to...
CLSA-2026-1771857684 Fix CVE(s): CVE-2025-14087, CVE-2025-14512
SECURITY UPDATE: Buffer underflow in GVariant parser leads to heap corruption - debian/patches/CVE-2025-1408714512.patch: Fix integer overflows in GVariant text format parser when processing input longer than INTMAX - CVE-2025-14087 SECURITY UPDATE: Integer overflow in escapebytestring leads to...
CLSA-2026-1771857466 Fix CVE(s): CVE-2025-14087
SECURITY UPDATE: Buffer underflow / integer overflow in GVariant text format parser - debian/patches/CVE-2025-14087.patch: fix potential integer overflow parsing strings, bytestrings, and child element counts in gvariant-parser.c - CVE-2025-14087...
CLSA-2026-1771854105 glib2: Fix of CVE-2025-14087
CVE-2025-14087: fix integer overflow in GVariant parser leading to heap corruption via buffer underflow when processing malicious input strings...
CLSA-2026-1771597605 Fix CVE(s): CVE-2025-15367
SECURITY UPDATE: defect in poplib module, when passed a user-controlled command, commands can be injected using newlines - debian/patches/CVE-2025-15367.patch: Fix command injection by rejecting commands containing control characters - CVE-2025-15367...
CLSA-2026-1771580716 glib2: Fix of CVE-2025-14087
CVE-2025-14087: Fix integer overflow in GVariant parser leading to heap corruption via buffer underflow when processing malicious input strings...
CLSA-2026-1771504803 grub2: Fix of CVE-2025-61662
CVE-2025-61662: fix use-after-free in gettext/gettext due to unregistered gettext command on module unload...
CLSA-2026-1771501223 curl: Fix of CVE-2025-15079
CVE-2025-15079: fix accepting hosts not present in the specified knownhosts during SSH-based SCP/SFTP transfers when global knownhosts contained them restrict host verification to the specified knownhosts file...
CLSA-2026-1771412927 glib2: Fix of CVE-2025-14087
CVE-2025-14087: fix integer overflow when parsing bytestrings...
CLSA-2026-1771409779 Fix CVE(s): CVE-2025-68618, CVE-2025-69204
SECURITY UPDATE: Malicious SVG file resulted in a DoS attack - debian/patches/CVE-2025-68618.patch: fix DOS when processing a specially crafted malicious SVG file - CVE-2025-68618 SECURITY UPDATE: WriteSVGImage function, using an int variable to store numberattributes caused an integer overflow a...
CLSA-2026-1771237525 Fix CVE(s): CVE-2025-69419
SECURITY UPDATE: check return code of UTF8putc - debian/patches/CVE-2025-69419.patch: add missing return code checks for UTF8putc in astrex.c and OPENSSLuni2utf8 in p12utl.c. - CVE-2025-69419...