MGASA-2013-0242 Updated putty and filezilla packages fixes security vulnerability

PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication, caused by improper bounds checking of the length parameter received from the SSH serve...

MGASA-2013-0228 Updated squid packages fix security vulnerabilities

Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger a buffer overflow in Squid, resulting in a termination of the Squid...

MGASA-2013-0211 Updated kernel-rt package fixes security issues

This kernel-rt update provides the upstream 3.4.52 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a...

MGASA-2013-0196 Updated otrs package fixes security vulnerabilities

An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see CVE-2013-3551, CVE-2013-4088...

MGASA-2013-0184 Updated perl-Module-Signature package fixes CVE-2013-2145

Arbitrary code execution vulnerability in Module::Signature before 0.72 CVE-2013-2145...

MGASA-2013-0169 Updated qemu packages fix security vulnerability

It was found that QEMU Guest Agent the "qemu-ga" service created certain files with world-writable permissions when run in daemon mode the default mode. An unprivileged guest user could use this flaw to consume all free space on the partition containing the qemu-ga log file, or modify the content...

MGASA-2026-0427 Updated gawk packages fix security vulnerabilities

Use after free in gawk. CVE-2026-40467 Heap buffer overflow in gawk. CVE-2026-40468 Heap buffer overflow in gawk. CVE-2026-40469 Stack-based buffer overflow in gawk. CVE-2026-40553...

MGASA-2026-0401 Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...

MGASA-2026-0405 Updated unzip packages fix security vulnerabilities

Vulnerabilities were discovered in the Info-ZIP unzip program, which could result in the execution of arbitrary code if a specially crafted file is processed...

MGASA-2026-0402 Updated libssh2 packages fix security vulnerabilities

Double-Free Heap Corruption via sftpopen. CVE-2026-66032 Integer Underflow DoS via AES-GCM Cipher Negotiation. CVE-2026-66033 Heap Buffer Overflow via ETM Cipher Negotiation. CVE-2026-66035...

MGASA-2026-0385 Updated dovecot package fixes security vulnerabilities

submission-login: Panic when mailmaxuseripconnections is reached: Panic: epollctldel, 8 failed: Bad file descriptor. CVE-2026-33263 Dovecot IMAP LIST matchsub Exponential Backtracking — CPU Denial of Service. CVE-2026-33607 DoS by sending mail with bad header. CVE-2026-27852 dsync: Mail content c...

MGASA-2026-0328 Updated openslide packages fix a security vulnerability

Arbitrary memory write with crafted Ventana BIF file. CVE-2026-48977...

MGASA-2026-0326 Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fix various security issues. See the links to get complete information of each issue...

MGASA-2026-0184 Updated wireshark packages fix security vulnerabilities

Multiple vulnerabilities have been discovered in Wireshark, a network protocol analyzer, which could result in denial of service or the execution of arbitrary code. This update fixes the reported issue...

MGASA-2026-0133 Updated flatpak packages fix security vulnerabilities

Complete sandbox escape leading to host file access and code execution in the host context. CVE-2026-34078 Arbitrary file deletion on the host filesystem. CVE-2026-34079...

MGASA-2026-0103 Updated giflib packages fix security vulnerability

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. CVE-2026-23868...

MGASA-2026-0077 Updated vim packages fix security vulnerability

Vim tabpanel modeline escape affects Vim 9.2.0272...

MGASA-2026-0060 Updated graphicsmagick & imagemagick packages fix security vulnerabilities

Division-by-Zero in YUV sampling factor validation leads to crash. CVE-2026-25799...

MGASA-2026-0052 Updated rootcerts, nss & firefox packages fix security vulnerabilities

Incorrect boundary conditions in the WebRTC: Audio/Video component. CVE-2026-2757 Use-after-free in the JavaScript: GC component. CVE-2026-2758 Incorrect boundary conditions in the Graphics: ImageLib component. CVE-2026-2759 Sandbox escape due to incorrect boundary conditions in the Graphics:...

MGASA-2026-0028 Updated gpsd packages fix security vulnerabilities

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/drivernmea2000.c file. The hnd129540 function, which handles NMEA2000 PGN 129540 GNSS Satellites in View packets, fails to validate the user-supplied satellite count against the size of the skyview...

MGASA-2026-0023 Updated glib2.0 packages fix security vulnerabilities

Glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with gdatetimenewfromiso8601. CVE-2025-3360 Buffer under-read on glib through glib/gfileutils.c via gettmpfile. CVE-2025-7039 Integer overflow in gescapeuristring...

MGASA-2026-0018 Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links...

MGASA-2026-0017 Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.120 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel...

MGASA-2026-0009 Updated nodejs packages fix security vulnerabilities

Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame. CVE-2025-59465 Uncatchable "Maximum call stack size exceeded" error on Node.js via asynchooks leads to process crashes bypassing error handlers. CVE-2025-59466 Bypass File System Permissions using crafted...

MGASA-2025-0330 Updated php packages fix security vulnerabilities

Opcache: - Reset global pointers to prevent use-after-free in zendjitstatus. PDO: - Fixed PDO quoting result null deref. Standard: - Fixed Null byte termination in dnsgetrecord - Heap buffer overflow in arraymerge - Information Leak of Memory in getimagesize...

MGASA-2025-0315 Updated cups packages fix security vulnerabilities

The updated packages fix security vulnerabilities and a regression with GTK+ apps caused by the fix for CVE-2025-58436: OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack. CVE-2025-58436 OpenPrinting CUPS vulnerable to stack based out-of-bound write. CVE-2025-61915...

MGASA-2025-0311 Updated ruby-rack packages fix security vulnerabilities

Possible Log Injection in Rack::CommonLogger. CVE-2025-25184 Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection. CVE-2025-27111 Local File Inclusion in Rack::Static. CVE-2025-27610...

MGASA-2025-0309 Updated kernel, kmod-xtables-addons & kmod-virtualbox packages fix security vulnerabilities

Upstream kernel version 6.6.116 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel...

MGASA-2025-0300 Updated firefox packages fix security vulnerabilities

Race condition in the Graphics component. CVE-2025-13012 Mitigation bypass in the DOM: Core & HTML component. CVE-2025-13013 CVE-2025-13014: Use-after-free in the Audio/Video component. CVE-2025-13014 Spoofing issue in Firefox. CVE-2025-13015 Incorrect boundary conditions in the JavaScript:...

MGASA-2025-0277 Updated perl-FCGI packages fix security vulnerability

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library. CVE-2025-40907...

MGASA-2025-0263 Updated x11-server, x11-server-xwayland & tigervnc packages fix security vulnerabilities

Use-after-free in XPresentNotify structures creation. CVE-2025-62229 Use-after-free in Xkb client resource removal. CVE-2025-62230 Value overflow in Xkb extension XkbSetCompatMap. CVE-2025-62231...

MGASA-2025-0252 Updated libtiff packages fix security vulnerabilities

LibTIFF fax2ps tiff2pdf.c t2preadtiffinit null pointer dereference. CVE-2024-13978 LibTIFF tiffmedian.c gethistogram use after free. CVE-2025-8176 LibTIFF thumbnail.c setrow buffer overflow. CVE-2025-8177 libtiff tiff2ps tiff2ps.c PSLvl2page null pointer dereference. CVE-2025-8534 LibTIFF tiffcro...

MGASA-2025-0244 Updated openssl packages fix a security vulnerability

Out-of-bounds read & write in RFC 3211 KEK Unwrap. CVE-2025-9230...

MGASA-2025-0245 Updated nginx package fixes security vulnerability

It was discovered that nginx contains a security issue in the ngxmailsmtpmodule which might allow an attacker to cause buffer over-read potentially resulting in sensitive information leak in a HTTP request to the authentication server CVE-2025-53859...

MGASA-2025-0225 Updated gnutls packages fix vulnerabilities

null pointer dereference in gnutlsfigurecommonciphersuite. CVE-2025-6395 Vulnerability in gnutls othername san export. CVE-2025-32988 Vulnerability in gnutls sct extension parsing. CVE-2025-32989 Vulnerability in gnutls certtool template parsing. CVE-2025-32990...

MGASA-2025-0213 Updated sudo packages fix security vulnerabilities

CVE-2025-32462 - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines CVE-2025-32463 - Sudo before 1.9.17p1 allows local users to obtain root access because...

MGASA-2025-0200 Updated libarchive packages fix security vulnerabilities

Double free at archivereadformatrarseekdata in archivereadsupportformatrar.c. CVE-2025-5914 Heap buffer over read in copyfromlzsswindow at archivereadsupportformatrar.c. CVE-2025-5915 Integer overflow while reading warc files at archivereadsupportformatwarc.c. CVE-2025-5916 Off by one error in...

MGASA-2025-0147 Updated apache-mod_auth_openidc packages fix security vulnerability

modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data. CVE-2025-31492...

MGASA-2025-0061 Updated ark packages fix security vulnerability

A security issue exists in Ark where a maliciously crafted archive containing file paths beginning with "/" allows files to be extracted to locations outside the intended directory...

MGASA-2025-0034 Updated libxml2 packages fix security vulnerability

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. CVE-2022-49043...

MGASA-2025-0028 Updated git-lfs packages fix security vulnerability

Git LFS permits exfiltration of credentials via crafted HTTP URLs. CVE-2024-53263...

MGASA-2024-0385 Updated krb5 packages fix security vulnerability

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. CVE-2024-3596...

MGASA-2024-0382 Updated libsoup3 & libsoup packages fix security vulnerabilities

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. CVE-2024-52530 GNOME libsoup before 3.6.1...

MGASA-2024-0380 Updated dcmtk packages fix security vulnerability

A buffer overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component. CVE-2024-27628...

MGASA-2024-0378 Updated wget packages fix security vulnerability

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. CVE-2024-10524...

MGASA-2024-0365 Updated thunderbird packages fix security vulnerability

Potential disclosure of plaintext in OpenPGP encrypted message. CVE-2024-11159...

MGASA-2024-0355 Updated openssl packages fix security vulnerability

Low-level invalid GF2^m parameters lead to OOB memory accesses. CVE-2024-9143...

MGASA-2024-0330 Updated quictls packages fix security vulnerabilities

The updated packages fix security vulnerabilities...

MGASA-2024-0324 Updated cjson packages fix security vulnerability

cJSON was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSONSetValuestring at cJSON.c. CVE-2024-31755...

MGASA-2024-0223 Updated nano packages fix security vulnerability

A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privilege...