10560 matches found
CLSA-2026-1770370767 curl: Fix of CVE-2025-9086
CVE-2025-9086: cookie: don't treat the leading slash as trailing...
CLSA-2026-1769773749 net-snmp: Fix of CVE-2025-68615
CVE-2025-68615: fix buffer overflow vulnerability in net-snmp snmptrapd daemon...
CLSA-2026-1769597819 Fix CVE(s): CVE-2025-58436
SECURITY UPDATE: cupsd DoS via slow client connections - debian/patches/CVE-2025-58436.patch: implement non-blocking I/O and connection timeouts to prevent slow clients from blocking cupsd. - CVE-2025-58436...
CLSA-2026-1769513855 tar: Fix of CVE-2025-45582
CVE-2025-45582: fixed path traversal vulnerability using malicious archive extraction...
CLSA-2026-1769507695 Fix CVE(s): CVE-2024-50349
SECURITY UPDATE: Confusing users into sending their passwords to sites under the attacker’s control using crafted URLs - debian/patches/CVE-2024-50349.patch: also encode : in credentialformat, sanitize the user prompt - CVE-2024-50349...
CLSA-2026-1769507433 cups: Fix of CVE-2025-58436
CVE-2025-58436: fix issue where slow messages could delay cupsd...
CLSA-2026-1769445556 php: Fix of CVE-2025-14178
CVE-2025-14178: fix heap buffer overflow in arraymerge due to integer overflow in zendhashnumelements precomputation...
CLSA-2026-1769426059 gnupg2: Fix of CVE-2025-68973
CVE-2025-68973: fix possible memory corruption in the armor parser that could lead to out-of-bounds write for crafted input...
CLSA-2026-1769424492 gpsd-minimal: Fix of 2 CVEs
CVE-2025-67268: fix heap-based buffer overrun in NMEA2000 GNSS satellite handling - CVE-2025-67269: fix integer underflow in NAVCOM packet parsing to prevent excessive payload length and CPU-exhaustion...
CLSA-2026-1769182340 gnupg2: Fix of CVE-2025-68973
CVE-2025-68973: fix memory corruption in the armor parser that leads to out-of-bounds write for malicious input...
CLSA-2026-1769164564 php: Fix of CVE-2025-14178
CVE-2025-14178: fix heap buffer overflow in arraymerge by preventing integer overflow in precomputation of element counts...
CLSA-2026-1769163825 gnupg2: Fix of CVE-2025-68973
CVE-2025-68973: fix faulty double increment...
CLSA-2026-1769163161 gnupg2: Fix of CVE-2025-68973
CVE-2025-68973: fix faulty double increment...
CLSA-2026-1769014292 httpd: Fix of 2 CVEs
CVE-2025-66200: don't use request notes for suexec, stop accepting the obscure "note" option in RequestHeader - CVE-2025-65082: fix precedence of envvars from HTTP headers and Apache configuration...
CLSA-2026-1768861951 Update of gnutls
Backport CVE fixes - Bump version to solve conflict with community package...
CLSA-2026-1768821437 pki-servlet-engine: Fix of 2 CVEs
CVE-2025-31651: fix improper neutralization of escape, meta, or control sequences - CVE-2025-55752: fix relative path traversal vulnerability...
CLSA-2026-1768555539 libsoup: Fix of CVE-2025-14523
CVE-2025-14523: reject duplicate Host headers...
CLSA-2026-1768410745 aide: Fix of CVE-2025-54389
CVE-2025-54389: escape filenames in error/log messages to prevent terminal escape sequence injection...
CLSA-2026-1768393530 git: Fix of CVE-2024-32021
CVE-2024-32021: fix symlink vulnerability allowing creation of hardlinks to arbitrary files in local source repository cloning...
CLSA-2026-1767970357 httpd: Fix of CVE-2025-58098
CVE-2025-58098: fix passes the shell-escaped query string to exec cmd="..." directives...
CLSA-2026-1767700458 python3: Fix of CVE-2025-4516
CVE-2025-4516: use-after-free in unicode-escape decoder with custom error handlers...
CLSA-2026-1767697963 Fix CVE(s): CVE-2025-11083
SECURITY UPDATE: Heap-based buffer overflow in elfswapshdr function - debian/patches/CVE-2025-11083.patch: Avoid a linker crash by rejecting corrupt section headers in linker input files. Changed elfswapshdrin to return bfdboolean and validate section sizes against file size to detect and reject...
CLSA-2025-1767027096 httpd: Fix of CVE-2025-58098
CVE-2025-58098: prevent SSI args from being passed to CGI scripts...
CLSA-2025-1767000167 php: Fix of CVE-2025-1735
CVE-2025-1735: add error checks to prevent crashes and improperly escaped data when PostgreSQL rejects invalid strings...
CLSA-2025-1766502928 skopeo: Fix of CVE-2025-58183
CVE-2025-58183: fix unbounded memory consumption when reading GNU pax 1.0 sparse files by rebuilding with golang 1.22.5...
CLSA-2025-1766501126 elfutils: Fix of 3 CVEs
CVE-2025-1371: fix null pointer dereference in eu-readelf when processing corrupt ELF files with broken program headers - CVE-2025-1376: fix denial of service in libelf when processing sections without data elfstrptr on sections with shsize set but no data - CVE-2025-1377: fix denial of service...
CLSA-2025-1766138358 Update of golang
Update to Go 1.25.3...
CLSA-2025-1766137116 Fix CVE(s): CVE-2025-6020
Reworked CVE-2025-6020 patches to preserve ABI compatibility - Add pammodutilsanitizehelperfds as a static inline helper in the header for modules - Keep the exported pammodutilsanitizehelperfds in libpam as a wrapper that calls the new helper...
CLSA-2025-1766050574 podman: Fix of CVE-2025-52881
CVE-2025-52881: fix security vulnerability in /proc file handle operations - Partial backport: add pathrs-lite library from runc v1.2.8 vendor directory...
CLSA-2025-1765463952 cups: Fix of CVE-2025-58364
CVE-2025-58364: fix unsafe deserialization and validation of printer attributes causing null dereference...
CLSA-2025-1765546516 libtiff: Fix of CVE-2023-52356
CVE-2023-52356: add col/row validation in TIFFReadRGBAStrip/TIFFReadRGBATile to prevent heap-buffer overflow and potential DoS...
CLSA-2025-1765478108 Fix CVE(s): CVE-2025-11839, CVE-2025-11840
SECURITY UPDATE: remove abort call in debug format printing code - debian/patches/CVE-2025-11839.patch: remove call to abort in the debug format printing code, allowing display of fuzzed input files to complete without triggering an abort - CVE-2025-11839 SECURITY UPDATE: fix SEGV in vfinfo -...
CLSA-2025-1765288864 libpng: Fix of CVE-2025-64505
CVE-2025-64505: fix heap buffer over-read vulnerability in pngdoquantize function...
CLSA-2025-1765287210 tracker-miners: Fix of CVE-2023-5557
CVE-2023-5557: fix seccomp rules, backport fix for CVE-2023-5557 added improvements from upstream regards seccomp...
CLSA-2025-1765285897 Fix CVE(s): CVE-2021-3738
SECURITY UPDATE: use after free in Samba AD DC RPC server - debian/patches/CVE-2021-3738-pre.patch: prepare service routines before fixing CVE-2021-3738 - debian/patches/CVE-2021-3738.patch: avoids a crash caused by use-after-free in Samba AD DC RPC server - CVE-2021-3738.patch...
CLSA-2025-1765012494 gimp: Fix of 2 CVEs
CVE-2025-10922: fix heap-based buffer overflow in DCM file parser by adding safety checks and proper GError handling to prevent potential RCE - CVE-2025-10934: fix heap-based buffer overflow in XWD file parser by validating colormap offsets to prevent potential RCE...
CLSA-2025-1764774571 gstreamer1: Fix of CVE-2024-47606
CVE-2024-47606: fix integer overflow when allocating sysmem and avoid integer overflow in qtdemux theora extension parsing...
CLSA-2025-1764772111 jackson-modules-base: Fix of CVE-2025-52999
Rebuilt with the CVE-2025-52999: fixed jackson-core version - Fixed build: replaced missing packages with a patch for PackageVersion...
CLSA-2025-1764325063 libblockdev: Fix of CVE-2025-6019
CVE-2025-6019: don't allow suid and dev set on fs resize...
CLSA-2025-1764234735 webkit2gtk3: Fix of CVE-2025-43343
Update to 2.50.1. The following CVE was fixed: - CVE-2025-43343: fix memory handling issue causing unexpected process crashes with malicious web content RHSA-2025:19919...
CLSA-2025-1764085222 cockpit: Fix of CVE-2024-2947
CVE-2024-2947: fix command injection vulnerability by sanitizing sosreport names during deletion...
CLSA-2025-1764029592 curl: Fix of CVE-2025-0167
CVE-2025-0167: fix password leakage issue when using .netrc file with no login or password in default entry and following HTTP redirects...
CLSA-2025-1763137741 python3.11-cryptography: Fix of CVE-2023-49083
CVE-2023-49083: fix crash when loading PKCS7 bundle with no certificates - Fix RUSTFLAGS macro expansion in build process...
CLSA-2025-1763025415 libtasn1: Fix of CVE-2024-12133
CVE-2024-12133: fix inefficient handling of specific certificate data in libtasn1 to prevent denial of service attacks...
CLSA-2025-1762957104 dhcp: Fix of CVE-2022-3094
Rebuild with the latest ELS version of bind to address CVE-2022-3094...
CLSA-2025-1762867600 git-lfs: Fix of CVE-2024-53263
CVE-2024-53263: fix issue where Git LFS could expose user credentials via URL- encoded control characters in host's URL...
CLSA-2025-1762784415 mod_http2: Fix of CVE-2025-49630
CVE-2025-49630: prevent denial of service attack by fixing assertion issue in modproxyhttp2...
CLSA-2025-1762535960 tar: Fix of CVE-2023-39804
CVE-2023-39804: fix crash in GNU tar caused by incorrect handling of extended PAX xattr headers leading to memory corruption DoS...