Advisory ROSA-SA-2021-1894

Software: libtar 1.2.11 OS: Cobalt 7.9 CVE-ID: CVE-2013-4420 CVE-Crit: HIGH CVE-DESC: Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files with a . dot in a created tar...

Advisory ROSA-SA-2021-1848

Software: gparted 0.33.0 OS: Cobalt 7.9 CVE-ID: CVE-2014-7208 CVE-Crit: HIGH CVE-DESC: GParted before version 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the created file system label. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2026-3310

CVE-ID: CVE-2021-33454 BDU-ID: None CVE-Crit: Medium CVE-DESCRIPTION: Vulnerability related to the pointer manipulation in yasm version 1.3.0, within the function yasmexprgetintnum in libyasm/expr.c. CVE-STATUS: The vulnerability has been fixed. CVE-REVIEW: To address this vulnerability, execute...

Advisory ROSA-SA-2026-3298

Software: wget 1.21.3 Operating System: ROSA-CHROME Unaffected versions: = wget-1.21.3-2 Affected versions: wget-1.21.3-2 CVE-ID: CVE-2024-38428 BDU-ID: 2024-04683 CVE-Crit: Medium CVE-DESCRIPTION: The vulnerability in the userinfo URI of the GNU Wget download manager is related to insecure...

Advisory ROSA-SA-2026-3282

software: libssh 0.9.8 OS: ROSA-CHROME unaffected versions = libssh-0.9.8-5 affected versions libssh-0.9.8-5 CVE-ID: CVE-2026-0965 BDU-ID: None CVE-Crit: LOW CVE-DESC.: A vulnerability in libssh is related to the ability to open arbitrary files during configuration parsing. A local attacker could...

Advisory ROSA-SA-2026-3277

software: binutils 2.38 WASP: ROSA-CHROME unaffected versions = binutils-2.38-8 affected versions binutils-2.38-8 CVE-ID: CVE-2025-69652 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the readelf utility of the GNU Binutils package is related to incorrect processing of specially...

Advisory ROSA-SA-2026-3264

Software: kernel 4.18.0 OS: ROSA Virtualization 3.1 unaffected versions = kernel-4.18.0-553.123.1.el810 affected versions lock, allowing a local attacker to cause a denial of service or execute arbitrary code when frequently switching a thread simultaneously with opening/closing a related...

Advisory ROSA-SA-2025-3067

Software: bzip2 1.0.6 OS: ROSA Virtualization 3.0 unaffected versions = bzip2-1.0.6-28.rv30 affected versions bzip2-1.0.6-28.rv30 CVE-ID: CVE-2019-12900 BDU-ID: CVE-Crit: HIGH CVE-DESC.: A vulnerability in the BZ2decompress decompress.c function of the bzip2 data compression utility is related to...

Advisory ROSA-SA-2025-3057

Software: xmlrpc-c 1.51.0 OS: ROSA Virtualization 3.1 unaffected versions = xmlrpc-c-1.51.0-11.0.1.rv31 affected versions xmlrpc-c-1.51.0-11.0.1.rv31 CVE-ID: CVE-2024-8176 BDU-ID: CVE-Crit: HIGH CVE-DESC.: A vulnerability in the libexpat XML file parsing library is related to a stack-based buffer...

Advisory ROSA-SA-2025-2976

Software: rsync 3.4.1 OS: ROSA-CHROME unaffected versions = rsync-3.4.1-1 affected versions rsync-3.4.1-1 CVE-ID: CVE-2024-12084 BDU-ID: 2025-00378 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the rsyncd daemon of the Rsync file transfer and synchronization utility is related to an operation...

Advisory ROSA-SA-2025-2810

Software: libxml2 2.9.7 OS: ROSA Virtualization 3.0 packageevrstring: libxml2-2.9.7-19.rv30 CVE-ID: CVE-2024-56171 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Vulnerability in libxml2: use-after-free in xmlschemas.c. CVE-STATUS: Vulnerability resolved. CVE-REV: To close the vulnerability, run the...

Advisory ROSA-SA-2025-2755

Software: pam 1.3.1 OS: ROSA Virtualization 2.1 packageevrstring: pam-1.3.1-36.rv3 CVE-ID: CVE-2024-10041 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in PAM allows an attacker to access sensitive information stored in memory through the execution of a victim program by sending...

Advisory ROSA-SA-2025-2730

Software: openssl 1.1.1k OS: ROSA Virtualization 3.0 packageevrstring: openssl-1.1.1k-12.0.2.rv30 CVE-ID: CVE-2024-0727 BDU-ID: 2024-01337 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the PKCS12parse, PKCS12unpackp7data, PKCS12unpackp7encdata, PKCS12unpackauthsafes, and PKCS12newpass functions ...

Advisory ROSA-SA-2025-2699

Software: perl-HTTP-Tiny 0.074 OS: ROSA Virtualization 3.0 packageevrstring: perl-HTTP-Tiny-0.074-2 CVE-ID: CVE-2023-31486 BDU-ID: 2023-03872 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Perl HTTP::Tiny programming language library is related to errors in the TLS certificate authentication...

Advisory ROSA-SA-2025-2661

software: perl 5.30.3 OS: ROSA-CHROME packageevrstring: perl-5.30.3 CVE-ID: CVE-2023-47100 BDU-ID: 2023-08382 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the Sparseunipropstring function of the regcomp.c file of the Perl programming language interpreter is related to an operation exceeding...

Advisory ROSA-SA-2025-2635

software: ncurses 6.2 WASP: ROSA-CHROME packageevrstring: ncurses-6.2 CVE-ID: CVE-2023-29491 BDU-ID: 2023-05772 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the ncurses terminal I/O control library is related to the ability to write beyond buffer boundaries in memory. Exploitation of the...

Advisory ROSA-SA-2025-2626

software: leptonica 1.82.0 WASP: ROSA-CHROME packageevrstring: leptonica-1.82.0-1 CVE-ID: CVE-2020-36277 BDU-ID: 2021-05306 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Leptonica image processing library involves the implementation of an incorrect control flow. Exploitation of the...

Advisory ROSA-SA-2024-2531

Software: python-idna 2.4 OS: rosa-server79 packageevrstring: python-idna-2.4-1.0.1.res7 CVE-ID: CVE-2024-3651 BDU-ID: 2024-04211 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the idna.encode function of the Internationalized Domain of Names in Applications IDNA is associated with uncontrolled...

Advisory ROSA-SA-2024-2502

Software: libndp 1.7 OS: ROSA Virtualization 2.1 packageevrstring: libndp-1.7-7.rv3 CVE-ID: CVE-2024-5564 BDU-ID: 2024-04337 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the libndp library is related to an operation exceeding buffer boundaries in memory. Exploitation of the vulnerability could...

Advisory ROSA-SA-2024-2473

software: net-snmp 5.9 WASP: ROSA-CHROME packageevrstring: net-snmp-5.9-3 CVE-ID: CVE-2022-44792 BDU-ID: 2024-06510 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the handleipDefaultTTL function of the Net-SNMP software suite of the Linux operating system is associated with a NULL Pointer...

Advisory ROSA-SA-2024-2470

software: systemd 249 WASP: ROSA-CHROME packageevrstring: systemd-249-1.gitfab79a.21 CVE-ID: CVE-2022-3821 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: An off-by-one error problem was discovered in Systemd in the formattimespan function time-util.c. An attacker could provide specific values for time...

Advisory ROSA-SA-2024-2469

software: pcs 0.10.7 WASP: ROSA-CHROME packageevrstring: pcs-0.10.7-5 CVE-ID: CVE-2022-1049 BDU-ID: 2022-05543 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the corosync/pacemaker PCS program configuration utility is related to flaws in the authentication procedure. Exploitation of the vulnerabili...

Advisory ROSA-SA-2024-2457

Software: snappy 1.1.8 OS: ROSA Virtualization 2.1 packageevrstring: snappy-1.1.8 CVE-ID: CVE-2023-28115 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the generateFromHtml function of the PHP Snappy library involves the recovery of invalid data from memory. Exploitation of the...

Advisory ROSA-SA-2023-2303

software: poppler 22.05.0 WASP: ROSA-CHROME packageevrstring: poppler-22.05.0-7.src.rpm CVE-ID: CVE-2023-34872 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Outline.cc for Poppler before version 23.06.0 allows a remote attacker to cause a denial of service DoS crash via a created PD...

Advisory ROSA-SA-2023-2297

software: puppet 7.25.0 OS: ROSA-CHROME packageevrstring: puppet-7.25.0-1.src.rpm CVE-ID: CVE-2021-27021 BDU-ID: 2022-01884 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PuppetDB database management system is related to the failure to take measures to protect the SQL query structure...

Advisory ROSA-SA-2023-2224

software: mosquitto 2.0.15 WASP: ROSA-CHROME packageevrstring: mosquitto-2.0.15-2.src.rpm CVE-ID: CVE-2021-34431 BDU-ID: 2022-01775 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Mosquitto message broker is related to incorrect processing of a CONNECT packet without will topic, will message i...

Advisory ROSA-SA-2021-1953

Software: poppler 0.26.5 OS: Cobalt 7.9 CVE-ID: CVE-2017-7511 CVE-Crit: MEDIUM CVE-DESC: poppler, since version 0.17.3, was vulnerable to null pointer dereferencing in pdfunite caused by specially crafted documents. CVE-STATUS: default CVE-REV: default CVE-ID: CVE-2017-7515 CVE-Crit: MEDIUM...

Advisory ROSA-SA-2021-1928

Software: netpbm 10.79.00 OS: Cobalt 7.9 CVE-ID: CVE-2018-8975 CVE-Crit: MEDIUM CVE-DESC: The pmmallocarray2 function in lib / util / mallocvar.c in Netpbm before version 10.81.03 allows remote attackers to cause a denial of service excessive heap-based buffer reads via a crafted image file, as...

Advisory ROSA-SA-2021-1911

Software: luajit 2.0.4 OS: Cobalt 7.9 CVE-ID: CVE-2020-24372 CVE-Crit: HIGH CVE-DESC: LuaJIT before 2.1.0-beta3 has out-of-range reads in ljerrrun in ljerr.c. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2021-1902

Software: libwebp 0.3.0 OS: Cobalt 7.9 CVE-ID: CVE-2016-9085 CVE-Crit: LOW CVE-DESC: multiple integer overflow in libwebp allows attackers to have undefined impact via unknown vectors. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2021-1866

Software: libdwarf 20130207 OS: Cobalt 7.9 CVE-ID: CVE-2016-5028 CVE-Crit: MEDIUM CVE-DESC: The printframeinstbytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service dereferencing a null pointer via an object file with empty bss-like sections. CVE-STATUS:...

Advisory ROSA-SA-2021-1850

Software: gstreamer 0.10.36 OS: Cobalt 7.9 CVE-ID: CVE-2016-10199 CVE-Crit: HIGH CVE-DESC: The qtdemuxtagaddstrfull function in gst / isomp4 / qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service read out of range and crash using a created...

Advisory ROSA-SA-2026-3312

Software: ffmpeg 4.4.6 OS: ROSA-CHROME Unaffected versions: = ffmpeg-4.4.6-4 Affected versions: ffmpeg-4.4.6-4 CVE-ID: CVE-2026-40962 BDU-ID: None CVE-Crit: Medium CVE-DESCRIPTION: The vulnerability related to integer overflow in FFmpeg allows an attacker to execute write operations beyond the...

Advisory ROSA-SA-2026-3292

CVE-ID: CVE-2026-46300 BDU-ID: None CVE-Crit: Not available CVE-DESCRIPTION: A vulnerability in the XFRM ESP-in-TCP subsystem of Linux kernels. A logical error occurs when transitioning a TCP socket to the espintcp mode after writing file data to the receive queue. The kernel processes file pages...

Advisory ROSA-SA-2026-3284

Software: tigervnc 1.13.1 OS: ROSA-CHROME unaffected versions = tigervnc-1.13.1-2 affected versions tigervnc-1.13.1-2 CVE-ID: CVE-2026-34352 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An invalid permissions vulnerability in the Image.cxx component of x0vncserver in TigerVNC allows other users to view...

Advisory ROSA-SA-2026-3278

software: curl 8.7.1 OS: ROSA-CHROME unaffected versions = curl-8.7.1-7 affected versions curl-8.7.1-7 CVE-ID: CVE-2026-3784 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in curl involves incorrectly reusing an existing HTTP proxy connection CONNECT when making requests with different...

Advisory ROSA-SA-2026-3271

Software: open-vm-tools 12.5.2 OS: ROSA-CHROME unaffected versions = open-vm-tools-12.5.2-1 affected versions open-vm-tools-12.5.2-1 CVE-ID: CVE-2025-22247 BDU-ID: 2025-05681 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the VMware Tools suite of utilities is related to incorrectly identifying a...

Advisory ROSA-SA-2026-3265

software: kernel-6.12 6.12.74 WASP: ROSA-CHROME unaffected versions = kernel-6.12-6.12.74-9 affected versions kernel-6.12-6.12.74-9 CVE-ID: CVE-2026-43284 BDU-ID: None CVE-Crit: NO DATA CVE-DESC.: A vulnerability in the Linux kernel's xfrm subsystem ESP allows data decryption over non-packet skb...

Advisory ROSA-SA-2026-3262

Software: kernel 4.18.0 OS: ROSA Virtualization 3.0 unaffected versions = kernel-4.18.0-553.123.1.el810 affected versions lock, allowing a local attacker to cause a denial of service or execute arbitrary code when frequently switching a thread simultaneously with opening/closing a related...

Advisory ROSA-SA-2026-3251

software: glibc 2.33 AXIS: ROSA-CHROME unaffected versions = glibc-2.33-11.git5f08d1.5 affected versions glibc-2.33-11.git5f08d1.5 CVE-ID: CVE-2026-0915 BDU-ID: 2026-02104 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the getnetbyaddr and getnetbyaddrr functions of the GNU C Library system library...

Advisory ROSA-SA-2026-3224

software: tpm2-tools 5.5.1 OS: ROSA-CHROME unaffected versions = tpm2-tools-5.5.1-1 affected versions tpm2-tools-5.5.1-1 CVE-ID: CVE-2024-29039 BDU-ID: 2025-16174 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the tpm2 checkquote component of the Trusted Platform Module tpm2-tools repository fo...

Advisory ROSA-SA-2026-3216

software: libpng 1.6.53 WASP: ROSA-CHROME unaffected versions = libpng-1.6.53-1 affected versions libpng-1.6.53-1 CVE-ID: CVE-2025-64505 BDU-ID: 2026-02923 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the pngdoquantize function of the pngrtran.c component of the PNG Libpng bitmap graphics libra...

Advisory ROSA-SA-2025-2896

Software: zlib 1.2.7 OS: rosa-server79 packageevrstring: zlib-1.2.7-21.0.1.res7 CVE-ID: CVE-2025-4638 BDU-ID: None CVE-Crit: DATA LOSSES. CVE-DESC.: A vulnerability in the zlib library embedded in PointCloudLibrary PCL allows attackers to cause undefined behavior via incorrect pointer arithmetic...

Advisory ROSA-SA-2025-2733

Software: unbound 1.16.2 OS: ROSA Virtualization 3.0 packageevrstring: unbound-1.16.2-5.8.rv30 CVE-ID: CVE-2023-50387 BDU-ID: 2024-01359 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the DNSSEC component of the DNS protocol implementation of the DNS server BIND is related to the algorithmic...

Advisory ROSA-SA-2025-2702

Software: ipmitool 1.8.18 OS: ROSA Virtualization 3.0 packageevrstring: ipmitool-1.8.18 CVE-ID: CVE-2020-5208 BDU-ID: 2020-03947 CVE-Crit: HIGH CVE-DESC.: An implementation vulnerability in multiple functions readfruarea, readfruareasection, ipmispdprintfru, ipmigetsessioninfo,...

Advisory ROSA-SA-2025-2673

software: curl 8.5.0 WASP: ROSA-CHROME packageevrstring: curl-8.5.0-1 CVE-ID: CVE-2023-46218 BDU-ID: 2024-02420 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the cURL command-line utility is related to the installation of "supercookie files" in Curl, which are then passed back to more sources...

Advisory ROSA-SA-2025-2671

software: shapelib 1.5.0 AXIS: ROSA-CHROME packageevrstring: shapelib-1.5.0-2 CVE-ID: CVE-2022-0699 BDU-ID: 2022-06588 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the implementation of the malloc function of the shapelib library is related to double memory freeing. Exploitation of the...

Advisory ROSA-SA-2025-2628

Software: libvncserver 0.9.13 OS: ROSA-CHROME packageevrstring: libvncserver-0.9.13-2 CVE-ID: CVE-2020-29260 BDU-ID: 2024-06666 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the rfbClientCleanup function of the libvncclient component of the libvncclient cross-platform LibVNCServer library is relat...

Advisory ROSA-SA-2025-2615

Software: wireshark 4.0.12 OS: ROSA-CHROME packageevrstring: wireshark-4.0.12-1 CVE-ID: CVE-2023-6174 BDU-ID: 2023-08355 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the SSH dissector of the Wireshark computer network traffic analyzer is related to insufficient cleaning of special elements in the...

Advisory ROSA-SA-2025-2599

software: binutils 2.38 WASP: ROSA-CHROME packageevrstring: binutils-2.38-5 CVE-ID: CVE-2022-35205 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Binutils allows attackers to perform a denial of service via displaydebugnames. CVE-STATUS: The vulnerability has been resolved CVE-REV: T...