Advisory ROSA-SA-2025-2623

software: ghostscript10 10.02.1 OS: ROSA-CHROME packageevrstring: ghostscript10-10.02.1-3 CVE-ID: CVE-2024-29506 BDU-ID: 2024-05558 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the pdfiapplyfilter function of the Ghostscript document processing, conversion, and generation software suite is...

Advisory ROSA-SA-2025-2599

software: binutils 2.38 WASP: ROSA-CHROME packageevrstring: binutils-2.38-5 CVE-ID: CVE-2022-35205 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Binutils allows attackers to perform a denial of service via displaydebugnames. CVE-STATUS: The vulnerability has been resolved CVE-REV: T...

Advisory ROSA-SA-2025-2574

software: libsndfile 1.1.0 OS: ROSA-CHROME packageevrstring: libsndfile-1.1.0-4 CVE-ID: CVE-2024-50612 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Vulnerability in libsndfile library: read outside array in oggvorbis.c. CVE-STATUS: The vulnerability has been resolved CVE-REV: To close the...

Advisory ROSA-SA-2025-2552

Software: perl 5.16.3 OS: rosa-server79 packageevrstring: perl-5.16.3-299.0.2.res7 CVE-ID: CVE-2015-8853 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Perl allows an attacker to cause a denial of service via crafted utf-8 data. CVE-STATUS: The vulnerability has been resolved. CVE-RE...

Advisory ROSA-SA-2024-2548

software: kubernetes 1.25.16 WASP: ROSA-CHROME packageevrstring: kubernetes-1.25.16-1 CVE-ID: CVE-2023-5528 BDU-ID: 2023-07938 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the kubelet utility of the Kubernetes virtual machine cluster management software tool is related to insufficient input...

Advisory ROSA-SA-2024-2516

software: libssh 0.9.7 OS: ROSA-CHROME packageevrstring: libssh-0.9.7-1 CVE-ID: CVE-2023-1667 BDU-ID: 2023-03857 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the LibSSH client authentication library is related to pointer dereferencing errors. Exploitation of the vulnerability allows an attacker...

Advisory ROSA-SA-2024-2488

Software: less 458 OS: rosa-server79 packageevrstring: less-458-10.res7 CVE-ID: CVE-2024-32487 BDU-ID: 2024-03717 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the UNIX-like UNIX text terminal utility Less is related to incorrect handling of quotation marks in the filename.c file. Exploitation of...

Advisory ROSA-SA-2024-2462

Software: gstreamer1.0-plugins-good 1.19.1 OS: ROSA-CHROME packageevrstring: gstreamer1.0-plugins-good-1.19.1-4 CVE-ID: CVE-2022-2122 BDU-ID: 2022-06453 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the qtdemuxinflate function of the Gstreamer multimedia framework is caused by an integer overflow...

Advisory ROSA-SA-2024-2404

SOFTWARE: 389-ds-base 1.4.3.8 OS: ROSA Virtualization 2.1 packageevrstring: 389-ds-base-1.4.3.8.src.rpm CVE-ID: CVE-2022-1949 BDU-ID: 2022-04434 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the search filter ldbmsearch.c of the 389 Directory Server is related to access delimitation flaws...

Advisory ROSA-SA-2024-2376

Software: dav1d 1.3.0 AXIS: ROSA-CHROME packageevrstring: dav1d-1.3.0-1.src.rpm CVE-ID: CVE-2023-32570 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: VideoLAN dav1d has a threadtask.c race condition that could cause an application crash associated with dav1ddecodeframeexit. CVE-STATUS: Fixed CVE-REV: T...

Advisory ROSA-SA-2023-2297

software: puppet 7.25.0 OS: ROSA-CHROME packageevrstring: puppet-7.25.0-1.src.rpm CVE-ID: CVE-2021-27021 BDU-ID: 2022-01884 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PuppetDB database management system is related to the failure to take measures to protect the SQL query structure...

Advisory ROSA-SA-2023-2225

software: pesign 116 WASP: ROSA-CHROME packageevrstring: pesign-116-1.src.rpm CVE-ID: CVE-2022-3560 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A flaw has been discovered in the design. The pesign package provides a systemd service used to run the pesign daemon. This service module runs a script to...

Advisory ROSA-SA-2023-2173

software: tnef 1.4.15 AXIS: ROSA-CHROME packageevrstring: tnef-1.4.15-3.src.rpm CVE-ID: CVE-2019-18849 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: In tnef before 1.4.18, an attacker could write to a victim's .ssh/authorizedkeys file via an email message with a created winmail.dat application/ms-tnef...

Advisory ROSA-SA-2021-1892

Software: libspiro 20071029 OS: Cobalt 7.9 CVE-ID: CVE-2019-19847. CVE-Crit: HIGH CVE-DESC: Libspiro before 20190731 has a stack-based buffer overflow in the spirotobpath0 function in spiro.c. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2026-3298

Software: wget 1.21.3 Operating System: ROSA-CHROME Unaffected versions: = wget-1.21.3-2 Affected versions: wget-1.21.3-2 CVE-ID: CVE-2024-38428 BDU-ID: 2024-04683 CVE-Crit: Medium CVE-DESCRIPTION: The vulnerability in the userinfo URI of the GNU Wget download manager is related to insecure...

Advisory ROSA-SA-2026-3291

software: kernel-5.10 5.10.244 WASP: ROSA-CHROME unaffected versions = kernel-5.10-5.10.244-4 affected versions data.opnents field during buffer management. By exploiting the RDS TCP transport SORDSTRANSPORT=2 in conjunction with iouring, a local unprivileged attacker can cause memory corruption...

Advisory ROSA-SA-2026-3287

software: kernel-6.12 6.12.74 WASP: ROSA-CHROME unaffected versions = kernel-6.12-6.12.74-13 affected versions data.opnents field during buffer management. By exploiting the RDS TCP transport SORDSTRANSPORT=2 in conjunction with iouring, a local unprivileged attacker can cause memory corruption a...

Advisory ROSA-SA-2026-3284

Software: tigervnc 1.13.1 OS: ROSA-CHROME unaffected versions = tigervnc-1.13.1-2 affected versions tigervnc-1.13.1-2 CVE-ID: CVE-2026-34352 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An invalid permissions vulnerability in the Image.cxx component of x0vncserver in TigerVNC allows other users to view...

Advisory ROSA-SA-2026-3282

software: libssh 0.9.8 OS: ROSA-CHROME unaffected versions = libssh-0.9.8-5 affected versions libssh-0.9.8-5 CVE-ID: CVE-2026-0965 BDU-ID: None CVE-Crit: LOW CVE-DESC.: A vulnerability in libssh is related to the ability to open arbitrary files during configuration parsing. A local attacker could...

Advisory ROSA-SA-2026-3281

software: libde265 1.0.18 OS: ROSA-CHROME unaffected versions = libde265-1.0.18-1 affected versions libde265-1.0.18-1 CVE-ID: CVE-2025-61147 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in strukturag libde265 commit d9fea9d is related to a segmentation error in the...

Advisory ROSA-SA-2026-3278

software: curl 8.7.1 OS: ROSA-CHROME unaffected versions = curl-8.7.1-7 affected versions curl-8.7.1-7 CVE-ID: CVE-2026-3784 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in curl involves incorrectly reusing an existing HTTP proxy connection CONNECT when making requests with different...

Advisory ROSA-SA-2026-3265

software: kernel-6.12 6.12.74 WASP: ROSA-CHROME unaffected versions = kernel-6.12-6.12.74-9 affected versions kernel-6.12-6.12.74-9 CVE-ID: CVE-2026-43284 BDU-ID: None CVE-Crit: NO DATA CVE-DESC.: A vulnerability in the Linux kernel's xfrm subsystem ESP allows data decryption over non-packet skb...

Advisory ROSA-SA-2026-3262

Software: kernel 4.18.0 OS: ROSA Virtualization 3.0 unaffected versions = kernel-4.18.0-553.123.1.el810 affected versions lock, allowing a local attacker to cause a denial of service or execute arbitrary code when frequently switching a thread simultaneously with opening/closing a related...

Advisory ROSA-SA-2026-3217

software: runc 1.3.4 OS: ROSA-CHROME unaffected versions = runc-1.3.4-1 affected versions runc-1.3.4-1 CVE-ID: CVE-2024-45310 BDU-ID: 2024-06891 CVE-Crit: LOW CVE-DESC.: A vulnerability in the Runc isolated container tool is associated with a race condition that allows link tracking. Exploitation...

Advisory ROSA-SA-2026-3216

software: libpng 1.6.53 WASP: ROSA-CHROME unaffected versions = libpng-1.6.53-1 affected versions libpng-1.6.53-1 CVE-ID: CVE-2025-64505 BDU-ID: 2026-02923 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the pngdoquantize function of the pngrtran.c component of the PNG Libpng bitmap graphics libra...

Advisory ROSA-SA-2026-3197

Software: pam 1.3.1 OS: ROSA Virtualization 2.1 unaffected versions = pam-1.3.1-39.rv3 affected versions pam-1.3.1-39.rv3 CVE-ID: CVE-2025-6020 BDU-ID: 2025-07273 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pamnamespace module of the Linux-PAM authentication module is caused by a race...

Advisory ROSA-SA-2025-3036

Software: postgresql13 13.21 OS: rosa-server79 unaffected versions = postgresql13-13.21-1PGDG.res7 affected versions postgresql13-13.21-1PGDG.res7 CVE-ID: CVE-2023-5869 BDU-ID: 2023-07840 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the arrayappend, arrayprepend, arraysubscripthandler functions o...

Advisory ROSA-SA-2025-2896

Software: zlib 1.2.7 OS: rosa-server79 packageevrstring: zlib-1.2.7-21.0.1.res7 CVE-ID: CVE-2025-4638 BDU-ID: None CVE-Crit: DATA LOSSES. CVE-DESC.: A vulnerability in the zlib library embedded in PointCloudLibrary PCL allows attackers to cause undefined behavior via incorrect pointer arithmetic...

Advisory ROSA-SA-2025-2869

Software: libxslt 1.1.28 OS: rosa-server79 packageevrstring: libxslt-1.1.28-6.0.1.1.res7 CVE-ID: CVE-2024-55549 BDU-ID: 2025-03641 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the xsltGetInheritedNsList function of the libxslt library is related to memory usage after it has been freed...

Advisory ROSA-SA-2025-2838

Software: cups 2.2.6 OS: ROSA Virtualization 2.1 packageevrstring: cups-2.2.6-62.0.1.rv3 CVE-ID: CVE-2024-47175 BDU-ID: 2024-07645 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the ppdCreatePPDFromIPP2 function of the CUPS print server libppd library is related to failure to take measures to...

Advisory ROSA-SA-2025-2823

Software: python-dns 1.15.0 OS: ROSA Virtualization 3.0 packageevrstring: python-dns-1.15.0-12.rv30 CVE-ID: CVE-2023-29483 BDU-ID: 2025-03301 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the Python toolkit dnspython is related to insufficient validation of user input. Exploitation of the...

Advisory ROSA-SA-2025-2811

Software: microcodectl 20250211 OS: ROSA Virtualization 3.0 packageevrstring: microcodectl-20250211-1.rv30 CVE-ID: CVE-2023-34440 BDU-ID: 2025-02776 CVE-Crit: MEDIUM. CVE-DESC.: A firmware vulnerability in the UEFI firmware of Intel processors is related to input validation flaws. Exploitation of...

Advisory ROSA-SA-2025-2786

software: kernel-6.1 6.1.128 OS: ROSA-CHROME packageevrstring: kernel-6.1-generic-6.1.128-1 CVE-ID: CVE-2024-27397 BDU-ID: 2025-00432 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the nftables netfilter component of the Linux operating system kernel is related to memory usage after it has been...

Advisory ROSA-SA-2025-2780

Software: pixman 0.38.4 OS: ROSA Virtualization 2.1 packageevrstring: pixman-0.38.4-4.rv3 CVE-ID: CVE-2020-35492 BDU-ID: 2021-03445 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the image-compositor.c component of the Cairo vector graphics library is related to a data stack buffer overflow...

Advisory ROSA-SA-2025-2720

Software: vim 8.0.1763 OS: ROSA Virtualization 3.0 packageevrstring: vim-8.0.1763 CVE-ID: CVE-2019-12735 BDU-ID: 2019-03251 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the getchar.c library of the Vim text editor is related to the lack of filtering of the "!source" command, which allows arbitrar...

Advisory ROSA-SA-2025-2644

Software: fonttools 4.28.5 WASP: ROSA-CHROME packageevrstring: fonttools-4.28.5 CVE-ID: CVE-2023-45139 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An XML External Entity Injection XXE vulnerability in the fontTools library allows an attacker to access arbitrary files or execute web requests. CVE-STATU...

Advisory ROSA-SA-2025-2594

software: freerdp 2.11.7 OS: ROSA-CHROME packageevrstring: freerdp-2.11.7-1 CVE-ID: CVE-2024-22211 BDU-ID: 2024-00706 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the freerdpbitmapplanarcontextreset function of the FreeRDP RDP client is related to an integer overflow when processing the...

Advisory ROSA-SA-2025-2593

software: qpdf 11.9.1 OS: ROSA-CHROME packageevrstring: qpdf-11.9.1-1 CVE-ID: CVE-2024-24246 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A heap buffer overflow vulnerability in qpdf allows attackers to cause application crashes via the std::sharedcount function in sharedptrbase.h. CVE-STATUS: The...

Advisory ROSA-SA-2025-2587

software: orc 0.4.40 WASP: ROSA-CHROME packageevrstring: orc-0.4.40-1 CVE-ID: CVE-2024-40897 BDU-ID: 2024-06669 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the orcparse.c file of the library for compiling and executing programs that operate on GStreamer ORC data arrays is related to a...

Advisory ROSA-SA-2025-2578

software: suricata 6.0.20 WASP: ROSA-CHROME packageevrstring: suricata-6.0.20-1 CVE-ID: CVE-2024-38535 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Vulnerability in Suricata parsing HTTP/2 traffic. CVE-STATUS: Vulnerability has been resolved. CVE-REV: To close the vulnerability, run the command: dnf...

Advisory ROSA-SA-2025-2550

Software: openldap 2.4.44 OS: rosa-server79 packageevrstring: openldap-2.4.44-25.0.2.res7 CVE-ID: CVE-2019-13057 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in OpenLDAP allows a server administrator with rootDN privileges to request authorization as another user from a different...

Advisory ROSA-SA-2024-2487

Software: flatpak 1.0.9 OS: rosa-server79 packageevrstring: flatpak-1.0.9-13.res7 CVE-ID: CVE-2021-41133 BDU-ID: 2022-00259 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Flatpak application and environment management tool is related to a lack of blocking in the seccomp filter of mount-related...

Advisory ROSA-SA-2024-2467

software: libxml2 2.9.14 OS: ROSA-CHROME packageevrstring: libxml2-2.9.14-5 CVE-ID: CVE-2023-45322 BDU-ID: 2023-06827 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the xmlUnlinkNode function tree.c of the libxml2 library is related to memory usage after it is freed. Exploitation of the vulnerabili...

Advisory ROSA-SA-2023-2283

software: dnsmasq 2.87 WASP: ROSA-CHROME packageevrstring: dnsmasq-2.87-2.src.rpm CVE-ID: CVE-2023-28450 BDU-ID: 2023-02265 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Dnsmasq DNS server is related to unrestricted resource allocation. Exploitation of the vulnerability could allow an attacker...

Advisory ROSA-SA-2023-2267

software: virglrenderer 0.8.1 OS: ROSA-CHROME packageevrstring: virglrenderer-0.8.1-3.src.rpm CVE-ID: CVE-2022-0135 BDU-ID: 2023-05686 CVE-Crit: HIGH CVE-DESC.: An out-of-bounds write issue has been discovered in the OpenGL VirGL virtual visualization tool virglrenderer. This vulnerability allows...

Advisory ROSA-SA-2023-2098

Software: samba 1.0 OS: testCVE-ID: test CVE-Crit: medium CVE-DESC: test CVE-STATUS: test CVE-REV: test...

Advisory ROSA-SA-2021-1986

Software: thunderbird 78.5.0 OS: Cobalt 7.9 CVE-ID: CVE-2020-26970 CVE-Crit: HIGH CVE-DESC: When reading SMTP server status codes, Thunderbird writes an integer value to a position in the stack that should contain only one byte. Depending on the processor architecture and stack structure, this...

Advisory ROSA-SA-2026-3296

CVE-ID: CVE-2020-10809 BDU-ID: 2024-07119 CVE-Crit: MEDIUM CVE-DESC.: Vulnerability in the Decompress function in the decompress.c file. This vulnerability is related to writing beyond the memory bounds. Exploitation of this vulnerability could allow an attacker to cause a service failure...

Advisory ROSA-SA-2026-3273

software: libtiff 4.1.0 OS: ROSA-CHROME unaffected versions = libtiff-4.1.0-10 affected versions libtiff-4.1.0-10 CVE-ID: CVE-2025-61143 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A null pointer dereferencing vulnerability in libtiff before version 4.7.1 via the tifopen.c component allows to cause ...

Advisory ROSA-SA-2026-3271

Software: open-vm-tools 12.5.2 OS: ROSA-CHROME unaffected versions = open-vm-tools-12.5.2-1 affected versions open-vm-tools-12.5.2-1 CVE-ID: CVE-2025-22247 BDU-ID: 2025-05681 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the VMware Tools suite of utilities is related to incorrectly identifying a...