10560 matches found
CLSA-2025-1764325063 libblockdev: Fix of CVE-2025-6019
CVE-2025-6019: don't allow suid and dev set on fs resize...
CLSA-2025-1764234735 webkit2gtk3: Fix of CVE-2025-43343
Update to 2.50.1. The following CVE was fixed: - CVE-2025-43343: fix memory handling issue causing unexpected process crashes with malicious web content RHSA-2025:19919...
CLSA-2025-1764085222 cockpit: Fix of CVE-2024-2947
CVE-2024-2947: fix command injection vulnerability by sanitizing sosreport names during deletion...
CLSA-2025-1764029592 curl: Fix of CVE-2025-0167
CVE-2025-0167: fix password leakage issue when using .netrc file with no login or password in default entry and following HTTP redirects...
CLSA-2025-1763137741 python3.11-cryptography: Fix of CVE-2023-49083
CVE-2023-49083: fix crash when loading PKCS7 bundle with no certificates - Fix RUSTFLAGS macro expansion in build process...
CLSA-2025-1763025415 libtasn1: Fix of CVE-2024-12133
CVE-2024-12133: fix inefficient handling of specific certificate data in libtasn1 to prevent denial of service attacks...
CLSA-2025-1762957104 dhcp: Fix of CVE-2022-3094
Rebuild with the latest ELS version of bind to address CVE-2022-3094...
CLSA-2025-1762867600 git-lfs: Fix of CVE-2024-53263
CVE-2024-53263: fix issue where Git LFS could expose user credentials via URL- encoded control characters in host's URL...
CLSA-2025-1762784415 mod_http2: Fix of CVE-2025-49630
CVE-2025-49630: prevent denial of service attack by fixing assertion issue in modproxyhttp2...
CLSA-2025-1762535960 tar: Fix of CVE-2023-39804
CVE-2023-39804: fix crash in GNU tar caused by incorrect handling of extended PAX xattr headers leading to memory corruption DoS...
CLSA-2025-1762243790 postgresql-jdbc: Fix of CVE-2024-1597
update to 42.2.28 - CVE-2024-1597: fix SQL injection in PostgreSQL JDBC simple query mode...
CLSA-2025-1762181946 frr: Fix of CVE-2023-38406
CVE-2023-38406: fix BGP Flowspec NLRI overflow vulnerability where zero-length packets could cause packet processing errors...
CLSA-2025-1761844638 Fix CVE(s): CVE-2023-49288, CVE-2023-5824
SECURITY UPDATE: excessive cached HTTP response header size causing worker process stall or crash - debian/patches/CVE-2023-5824.patch: Refactor serialized HTTP response header handling to prevent cache flow - CVE-2023-5824 SECURITY UPDATE: Use-After-Free in the HTTP Collapsed Forwarding Feature ...
CLSA-2025-1761844758 Fix CVE(s): CVE-2024-1013
SECURITY UPDATE: out-of-bounds stack write flaw in 64-bit architectures - debian/patches/CVE-2024-1013.patch: Fix incompatible pointer-to-integer types causing out-of-bounds stack writes on 64-bit architectures - CVE-2024-1013...
CLSA-2025-1761844351 gnutls: Fix of CVE-2025-6395
CVE-2025-6395: fix NULL pointer dereference in gnutlsfigurecommonciphersuite...
CLSA-2025-1761744708 git: Fix of CVE-2024-50349
CVE-2024-50349: fix issue where URLs can obfuscate the host asking for credentials, by using strbufaddpercentencode to sanitise the host name and port...
CLSA-2025-1761325428 golang: Fix of CVE-2025-47907
CVE-2025-47907: avoid closing Rows in database/sql while scanning is in progress...
CLSA-2025-1761139574 libxml2: Fix of CVE-2022-49043
CVE-2022-49043: fix use-after-free in xmlXIncludeAddNode, free URI after reporting the error to avoid use-after-free...
CLSA-2025-1761056680 xorg-x11-server: Fix of CVE-2025-49176
Additional fix for CVE-2025-49176...
CLSA-2025-1760646561 tigervnc: Fix of 13 CVEs
Rebuilt with xorg-x11-server-1.20.4-99.el79.tuxcare.els7, mitigating the security vulnerabilities identified by the following CVEs: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597 CVE-2025-26598, CVE-2025-26599, CVE-2025-26600 and CVE-2025-26601, CVE-2025-49175, CVE-2025-49176,...
CLSA-2025-1760017744 Fix CVE(s): CVE-2025-6491
SECURITY UPDATE: fix NULL pointer dereference in SOAP with huge QName - debian/patches/CVE-2025-6491.patch: Add safeguard in ext/soap/soap.c to handle invalid XML node names produced by libxml2 with extremely large namespace prefixes - CVE-2025-6491...
CLSA-2025-1759864646 jasper: Fix of CVE-2025-8837
CVE-2025-8837: fix use-after-free vulnerability in jpcdecdump...
CLSA-2025-1759856673 Fix CVE(s): CVE-2025-55154
SECURITY UPDATE: memory corruption vulnerability from unsafe magnified size calculations in ReadOneMNGIMage - debian/patches/CVE-2025-55154.patch: Fix type mismatch issue in png.c causing incorrect image dimensions calculation - CVE-2025-55154...
CLSA-2025-1759506149 krb5: Fix of CVE-2025-24528
CVE-2025-24528: fix buffer overflow vulnerability in iprop log file writing...
CLSA-2025-1759498325 jasper: Fix of CVE-2025-8837
CVE-2025-8837: fix use after free vulnerability in jpcdecdump function...
CLSA-2025-1759418654 cups: Fix of CVE-2025-58060
CVE-2025-58060: fix authentication bypass issue caused by not checking password when AuthType is not Basic...
CLSA-2025-1759336205 libxml2: Fix of CVE-2025-7425
Fix typo in CVE-2025-7425 fix...
CLSA-2025-1759330475 libssh: Fix of CVE-2025-5372
CVE-2025-5372: uninitialized key buffers caused by inconsistent sshkdf return value...
CLSA-2025-1759222758 ruby: Fix of 4 CVEs
CVE-2016-2337: Fix type confusion in canceleval Ruby's TclTkIp class method to prevent arbitrary code execution - CVE-2017-9224: Fix stack out-of-bounds read in matchat during regular expression searching - CVE-2017-9227: Fix stack out-of-bounds read in mbcenclen and invalid pointer dereference...
CLSA-2025-1758916739 Fix CVE(s): CVE-2025-58060
SECURITY UPDATE: authentication bypass vulnerability - debian/patches/CVE-2025-58060.patch: block authentication using alternate method in scheduler/auth.c - CVE-2025-58060...
CLSA-2025-1758892548 glibc: Fix of CVE-2025-4802
CVE-2025-4802: prevent untrusted LDLIBRARYPATH from loading dynamically shared libraries in statically compiled binaries that call dlopen...
CLSA-2025-1758825546 gimp: Fix of CVE-2025-48798
CVE-2025-48798: fix XCF loader use-after-free issues by properly managing layer/channel resources and ensuring safe cleanup during parsing...
CLSA-2025-1758821935 perl-CPAN: Fix of 2 CVEs
CVE-2023-31484: verify TLS certificates when downloading distributions over HTTPS - CVE-2020-16156: fix Signature Verification Bypass...
CLSA-2025-1758709744 gimp: Fix of CVE-2025-5473
CVE-2025-5473: fix parsing integer overflow issue in ICO file to prevent remote code execution...
CLSA-2025-1758709327 glib2: Fix of CVE-2024-52533
CVE-2024-52533: fix off-by-one error leading to buffer overflow in gsocks4aproxy.c...
CLSA-2025-1758228143 Fix CVE(s): CVE-2023-30630
SECURITY UPDATE: Overwrite a local file - debian/patches/CVE-2023-30630.patch: Prevent --dump-bin from overwriting local files to address privilege escalation vulnerability - CVE-2023-30630...
CLSA-2025-1757945157 python3.11: Fix of CVE-2025-8194
CVE-2025-8194: fix defect in 'TarFile' extraction and entry enumeration APIs to prevent infinite loop and deadlock when processing tar archives with negative offsets...
CLSA-2025-1757923104 glibc: Fix of CVE-2019-9169
CVE-2019-9169: fix heap-based buffer over-read in proceednextnode function in posix/regexec.c...
CLSA-2025-1757922878 kernel: Fix of 4 CVEs
net/sched: Always pass notifications when child class becomes empty CVE-2025-38350 - schcbq: make cbqqlennotify idempotent CVE-2025-38000 - schhtb: make htbqlennotify idempotent CVE-2025-37932 - codel: remove sch-q.qlen check before qdisctreereducebacklog CVE-2025-37798 - schqfq: make...
CLSA-2025-1757609292 nodejs: Fix of CVE-2024-22025
CVE-2024-22025: fix resource exhaustion DoS vulnerability in fetch function...
CLSA-2025-1757608663 rsync: Fix of CVE-2024-12087
CVE-2024-12087: fix a path traversal issue in --inc-recursive mode that let a malicious server escape the destination directory...
CLSA-2025-1757427057 grafana: Fix of CVE-2022-23552
CVE-2022-23552: sanitize SVG inputs in GeoMap by adding a dompurify preprocessor step, preventing stored XSS where malicious SVG could execute arbitrary JavaScript...
CLSA-2025-1757247437 zlib: Fix of CVE-2016-9840
CVE-2016-9840: fix undefined behavior in inftrees.c...
CLSA-2025-1757076749 Fix CVE(s): CVE-2025-54574
SECURITY UPDATE: Disable URN protocol access to prevent potential security vulnerabilities - debian/patches/CVE-2025-54574.patch: Add ACL rules to deny URN protocol access by default - CVE-2025-54574...
CLSA-2025-1756932191 buildah: Fix of CVE-2024-9407
CVE-2024-9407: validate input for bind-propagation option in Dockerfile RUN --mount instruction to prevent arbitrary parameter passing and potential file modification...
CLSA-2025-1756930773 glibc: Fix of CVE-2025-8058
CVE-2025-8058: fix double free vulnerability in regcomp function...
CLSA-2025-1756928514 libvpx: Fix of CVE-2025-5283
CVE-2025-5283: fix use after free vulnerability in libvpx to prevent potential heap corruption via crafted HTML page...
CLSA-2025-1756928434 python-setuptools: Fix of CVE-2025-47273
CVE-2025-47273: fix path traversal vulnerability in PackageIndex...
CLSA-2025-1756483693 php: Fix of 3 CVEs
CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation...