MGASA-2026-0404 Updated perl-HTML-FormFu packages fix a security vulnerability

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. CVE-2026-19873...

MGASA-2026-0407 Updated libcupsfilters & cups-filters packages fix security vulnerabilities

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel. CVE-2026-64611 cups image filter process abort via malformed png. CVE-2026-64612...

MGASA-2026-0395 Updated java-21-openjdk & java-17-openjdk packages fix security vulnerabilities

Enhance TLS certificate handling. CVE-2026-46968 Improve DTLS handshaking. CVE-2026-46917 Enhance JPEG handling. CVE-2026-47010 Enhance XBM image support. CVE-2026-47021 Enhance Jar file processing. CVE-2026-47027 Improve certification checking. CVE-2026-60147 Enhance AWT ImagingLib. CVE-2026-470...

MGASA-2026-0377 Updated python-linkify-it-py package fixes security vulnerabilities

LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. Fix quadratic complexity in LinkifyIt.match, port of linkify-it 5.0.1 and 5.0.2 upstream CVE-2026-48801, CVE-2026-59887 82 Match validators at a position instead of slicing the tail, needed because Pytho...

MGASA-2026-0374 Updated microcode packages fix security vulnerabilities

A potential security vulnerability for some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions Intel® TDX may allow escalation of privilege. CVE-2025-31936 A potential security vulnerability in some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions Intel® TDX may allow...

MGASA-2026-0342 Updated flatpak package fixes security vulnerabilities

Updated flatpak package fixes security vulnerabilities. Please see the links for additional information...

MGASA-2026-0322 Updated php packages fix security vulnerabilities

This update brings the latest version of php 8.2 and fixes some security vulnerabilities...

MGASA-2026-0313 Updated corosync and libqb packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Denial of service and information disclosure via crafted udp packet. CVE-2026-35091 Denial of service via integer overflow in join message validation. CVE-2026-35092 Additionally, libqb solves a missing runtime dependency on qb-blackbox...

MGASA-2026-0301 Updated nginx packages fix security vulnerabilities

CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string...

MGASA-2026-0199 Updated nghttp2 packages fix security vulnerability

Denial of service: Assertion failure due to missing state validation. CVE-2026-27135...

MGASA-2026-0196 Updated erlang-hex_core & erlang-rebar3 packages fix security vulnerability

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hexcore hexapi modules, hexpm hex mixhexapi modules, erlang rebar3 r3hexapi modules allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hexapi.erl,...

MGASA-2026-0108 Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel...

MGASA-2026-0107 Updated gvfs packages fix security vulnerabilities

Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses. CVE-2026-28295 Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths. CVE-2026-28296...

MGASA-2026-0094 Updated squid packages fix security vulnerabilities

Squid mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asnbuildobjid in lib/snmplib/asn1.c. CVE-2025-59362 Squid vulnerable to information disclosure via authentication credential leakage in error handling. CVE-2025-62168 Squid vulnerable to Denial of Service in ICP Request handling...

MGASA-2026-0085 Updated polkit-122 packages fix security vulnerability

Denial of service via unbounded input processing through standard input. CVE-2026-4897...

MGASA-2026-0082 Updated python-nltk packages fix security vulnerability

nltk Vulnerable to Cross-site Scripting. CVE-2026-33230...

MGASA-2026-0072 Updated strongswan packages fix security vulnerability

strongSwan 4.5.0 6.0.5 EAP-TTLS AVP Parsing Integer Underflow. CVE-2026-25075...

MGASA-2026-0064 Updated webkit2 packages fix security vulnerabilities

CVE-2025-43457 Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. CVE-2026-20608 Processing maliciously crafted web content may lead to an unexpected process crash. This issue was addressed throu...

MGASA-2026-0043 Updated microcode packages fix security vulnerabilities

The updated package updates AMD CPUs microcodes and fixes security vulnerabilities in Intel CPUs microcodes: Incorrect behavior order in transition between executive monitor and SMI transfer monitor STM in some IntelR Processor may allow a privileged user to potentially enable escalation of...

MGASA-2026-0037 Updated xrdp packages fix security vulnerability

xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow. CVE-2025-68670...

MGASA-2026-0025 Updated ceph packages fix security vulnerability

Updated ceph packages fix a security issue allowing an attacker to make Ceph accept any certificate...

MGASA-2026-0013 Updated nss & firefox packages fix security vulnerabilities

Mitigation bypass in the DOM: Security component. CVE-2026-0877 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. CVE-2026-0878 Sandbox escape due to incorrect boundary conditions in the Graphics component. CVE-2026-0879 Sandbox escape due to integer...

MGASA-2026-0014 Updated thunderbird packages fix security vulnerabilities

Mitigation bypass in the DOM: Security component. CVE-2026-0877 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. CVE-2026-0878 Sandbox escape due to incorrect boundary conditions in the Graphics component. CVE-2026-0879 Sandbox escape due to integer...

MGASA-2026-0011 Updated python-urllib3 packages fix security vulnerabilities

urllib3 allows an unbounded number of links in the decompression chain. CVE-2025-66418 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects streaming API. CVE-2026-21441...

MGASA-2025-0332 Updated roundcubemail packages fix security vulnerabilities

Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev...

MGASA-2025-0320 Updated python-django packages fix security vulnerabilities

Potential SQL injection in FilteredRelation column aliases on PostgreSQL. CVE-2025-13372 Potential denial-of-service vulnerability in XML serializer text extraction. CVE-2025-64460...

MGASA-2025-0321 Updated xkbcomp packages fix security vulnerabilities

Endless recursion in xkbcomp/expr.c resulting in a crash. CVE-2018-15853 NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash. CVE-2018-15859 NULL pointer dereference in ExprResolveLhs resulting in a crash. CVE-2018-15861 NULL pointer dereference in...

MGASA-2025-0292 Updated python-django packages fix security vulnerability

Potential SQL injection via connector keyword argument in QuerySet and Q objects. CVE-2025-64459...

MGASA-2025-0276 Updated perl-CPAN & perl-HTTP-Tiny packages fix security vulnerabilities

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. CVE-2023-31484 HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates...

MGASA-2025-0264 Updated gstreamer1.0-plugins-bad packages fix security vulnerability

GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. CVE-2025-3887...

MGASA-2025-0197 Updated thunderbird packages fix security vulnerabilities

CVE-2025-5262: A double-free could have occurred in vpxcodecencinitmulti after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. CVE-2025-5263: Error handling for script execution was incorrectly isolated fr...

MGASA-2025-0189 Updated docker packages fix security vulnerability

External DNS requests from 'internal' networks could lead to data exfiltration - CVE-2024-29018 We can't determine if docker 24.0.5 is affected but as it is no longer supported we are releasing version 25.0.7, as it is supported and free of the CVE...

MGASA-2025-0183 Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.93 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links...

MGASA-2025-0169 Updated cimg packages fix security vulnerability

A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimglibrary::CImg::loadanalyze. CVE-2024-26540...

MGASA-2025-0156 Updated java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk & java-latest-openjdk packages fix security vulnerabilities

Better TLS connection support. CVE-2025-21587 Improve compiler transformations. CVE-2025-30691 Enhance Buffered Image handling. CVE-2025-30698 The updated timezone data are needed by the new Java packages...

MGASA-2025-0129 Updated atop packages fix security vulnerability

atop through 2.11.0 allows local users to cause a denial of service e.g., assertion failure and application exit or possibly have unspecified other impact by running certain types of unprivileged processes while a different user runs atop. CVE-2025-31160...

MGASA-2025-0127 Updated corosync packages fix security vulnerability

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet. CVE-2025-30472...

MGASA-2025-0107 Updated vim packages fix security vulnerability

Vim vulnerable to potential data loss with zip.vim and special crafted zip files. CVE-2025-29768...

MGASA-2025-0089 Updated vim packages fix security vulnerability

Potential code execution with tar.vim and special crafted tar files...

MGASA-2025-0077 Updated iniparser packages fix security vulnerability

A heap-based buffer overflow vulnerability in iniparserdumpsectionini in iniparser allows an attacker to read out-of-bounds memory. CVE-2025-0633...

MGASA-2025-0016 Updated git packages fix security vulnerabilities

Git does not sanitize URLs when asking for credentials interactively. CVE-2024-50349 Newline confusion in credential helpers can lead to credential exfiltration in git. CVE-2024-52006...

MGASA-2025-0011 Updated ceph packages fix security vulnerability

Authentication bypass in CEPH RadosGW. CVE-2024-48916...

MGASA-2025-0007 Updated avahi packages fix security vulnerabilities

Avahi wide-area dns uses constant source port. CVE-2024-52615 Avahi wide-area dns predictable transaction ids. CVE-2024-52616...

MGASA-2024-0390 Updated socat packages fix security vulnerability

CVE-2024-54661: Fixed arbitrary file overwrite via predictable /tmp directory in socat readline.sh...

MGASA-2024-0384 Updated thunderbird packages fix security vulnerabilities

Select list elements could be shown over another site. CVE-2024-11692 CSP Bypass and XSS Exposure via Web Compatibility Shims. CVE-2024-11694 URL Bar Spoofing via Manipulated Punycode and Whitespace Characters. CVE-2024-11695 Unhandled Exception in Add-on Signature Verification. CVE-2024-11696...

MGASA-2024-0373 Updated libsndfile packages fix security vulnerability

libsndfile suffers from an out-of-bounds read in oggvorbis.c vorbisanalysiswrote...

MGASA-2024-0307 Updated clamav packages fix security vulnerabilities

Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service DoS condition. CVE-2024-20505 Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam'...

MGASA-2024-0308 Updated python3-webob package fix security vulnerability

When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. urlparse however treats a // at the start of a string as a URI without a scheme, and then trea...

MGASA-2024-0302 Updated microcode packages fix security vulnerabilities

Observable discrepancy in RAPL interface for some Intel® Processors may allow a privileged user to potentially enable information disclosure via local access. CVE-2024-23984 Improper finite state machines FSMs in hardware logic in some Intel® Processors may allow an privileged user to potentially...

MGASA-2024-0295 Updated libpcap packages fix security vulnerabilities

In affected libpcap versions during the setup of a remote packet capture the internal function sockinitaddress calls getaddrinfo and possibly freeaddrinfo, but does not clearly indicate to the caller function whether freeaddrinfo still remains to be called after the function returns. This makes i...