Advisory ROSA-SA-2025-2626

software: leptonica 1.82.0 WASP: ROSA-CHROME packageevrstring: leptonica-1.82.0-1 CVE-ID: CVE-2020-36277 BDU-ID: 2021-05306 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Leptonica image processing library involves the implementation of an incorrect control flow. Exploitation of the...

Advisory ROSA-SA-2025-2606

software: grub2 2.06 WASP: ROSA-CHROME packageevrstring: grub2-2.06-22 CVE-ID: CVE-2023-4692 BDU-ID: 2023-06822 CVE-Crit: LOW CVE-DESC.: A vulnerability in the fs/ntfs.c component of the Grub2 operating systems loader is related to a buffer overflow in dynamic memory. Exploitation of the...

Advisory ROSA-SA-2025-2579

software: suricata 6.0.20 WASP: ROSA-CHROME packageevrstring: suricata-6.0.20-2 CVE-ID: CVE-2024-45796 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Suricata allows an attacker to cause a failure in the reassembly of traffic fragments. CVE-STATUS: The vulnerability has been resolved...

Advisory ROSA-SA-2025-2572

software: squid 5.10 OS: ROSA-CHROME packageevrstring: squid-5.10-1 CVE-ID: CVE-2024-45802 BDU-ID: 2024-08860 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Squid proxy server is related to input processing errors. Exploitation of the vulnerability could allow an attacker acting remotely to cau...

Advisory ROSA-SA-2024-2531

Software: python-idna 2.4 OS: rosa-server79 packageevrstring: python-idna-2.4-1.0.1.res7 CVE-ID: CVE-2024-3651 BDU-ID: 2024-04211 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the idna.encode function of the Internationalized Domain of Names in Applications IDNA is associated with uncontrolled...

Advisory ROSA-SA-2024-2522

Software: libebml 1.3.9 OS: rosa-server79 packageevrstring: libebml-1.3.9-2.res7 CVE-ID: CVE-2023-52339 BDU-ID: 2024-02535 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the MemIOCallback.cpp file of the C++ libebml library is related to integer overflow. Exploitation of the vulnerability could all...

Advisory ROSA-SA-2024-2503

Software: wget 1.19.5 OS: ROSA Virtualization 2.1 packageevrstring: wget-1.19.5-12.rv3 CVE-ID: CVE-2024-38428 BDU-ID: 2024-04683 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the userinfo URI component of the GNU Wget download manager is related to insecure behavior in which data that should hav...

Advisory ROSA-SA-2024-2488

Software: less 458 OS: rosa-server79 packageevrstring: less-458-10.res7 CVE-ID: CVE-2024-32487 BDU-ID: 2024-03717 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the UNIX-like UNIX text terminal utility Less is related to incorrect handling of quotation marks in the filename.c file. Exploitation of...

Advisory ROSA-SA-2024-2470

software: systemd 249 WASP: ROSA-CHROME packageevrstring: systemd-249-1.gitfab79a.21 CVE-ID: CVE-2022-3821 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: An off-by-one error problem was discovered in Systemd in the formattimespan function time-util.c. An attacker could provide specific values for time...

Advisory ROSA-SA-2024-2423

Software: libmpeg2 0.5.1 OS: ROSA Virtualization 2.1 packageevrstring: libmpeg2-0.5.1 CVE-ID: CVE-2022-37416 BDU-ID: None CVE-Crit: N/A CVE-DESC.: Ittiam libmpeg2 uses memcpy with overlapping memory blocks in impeg2mcfullxfullxfullx8x8. CVE-STATUS: Not Relevant CVE-REV:...

Advisory ROSA-SA-2024-2329

software: puppet 7.25.0 OS: ROSA-CHROME packageevrstring: puppet-7.25.0-1.src.rpm CVE-ID: CVE-2021-27021 BDU-ID: 2022-01884 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PuppetDB database management system is related to the failure to take measures to protect the SQL query structure...

Advisory ROSA-SA-2024-2324

Software: xorg-x11-server 1.20.4 OS: rosa-server79 packageevrstring: xorg-x11-server-1.20.4-25.res7 CVE-ID: CVE-2023-6377 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An error has been detected in xorg-server. Requesting or modifying XKB button actions, such as switching from touchpad to mouse, can...

Advisory ROSA-SA-2023-2261

software: mujs 1.3.3 AXIS: ROSA-CHROME packageevrstring: mujs-1.3.3.3-1.src.rpm CVE-ID: CVE-2016-10141 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC.: An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS to...

Advisory ROSA-SA-2023-2098

Software: samba 1.0 OS: testCVE-ID: test CVE-Crit: medium CVE-DESC: test CVE-STATUS: test CVE-REV: test...

Advisory ROSA-SA-2023-2095

Software: tigervnc 1.8.0 OS: rosa-server79 packageevrstring: tigervnc-1.8.0-22 CVE-ID: CVE-2022-4283 BDU-ID: None CVE-Crit: HIGH CVE-DESC: A vulnerability has been discovered in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting i...

Advisory ROSA-SA-2021-1848

Software: gparted 0.33.0 OS: Cobalt 7.9 CVE-ID: CVE-2014-7208 CVE-Crit: HIGH CVE-DESC: GParted before version 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the created file system label. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2026-3296

CVE-ID: CVE-2020-10809 BDU-ID: 2024-07119 CVE-Crit: MEDIUM CVE-DESC.: Vulnerability in the Decompress function in the decompress.c file. This vulnerability is related to writing beyond the memory bounds. Exploitation of this vulnerability could allow an attacker to cause a service failure...

Advisory ROSA-SA-2026-3268

software: kernel-5.10 5.10.244 WASP: ROSA-CHROME unaffected versions = kernel-5.10-5.10.244-3 affected versions kernel-5.10-5.10.244-3 CVE-ID: CVE-2026-43284 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Linux kernel xfrm subsystem ESP allows data decryption over non-packet skb...

Advisory ROSA-SA-2026-3251

software: glibc 2.33 AXIS: ROSA-CHROME unaffected versions = glibc-2.33-11.git5f08d1.5 affected versions glibc-2.33-11.git5f08d1.5 CVE-ID: CVE-2026-0915 BDU-ID: 2026-02104 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the getnetbyaddr and getnetbyaddrr functions of the GNU C Library system library...

Advisory ROSA-SA-2026-3249

software: vim 9.1.2148 WASP: ROSA-CHROME unaffected versions = vim-9.1.2148-1 affected versions vim-9.1.2148-1 CVE-ID: CVE-2026-25749 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Heap overflow in Vim before version 9.1.2132 when processing the 'helpfile' option. In gettagfname src/tag.c, the value of...

Advisory ROSA-SA-2026-3179

Software: pam 1.3.1 OS: ROSA Virtualization 3.0 unaffected versions = pam-1.3.1-39.0.2.rv30 affected versions pam-1.3.1-39.0.2.rv30 CVE-ID: CVE-2025-6020 BDU-ID: 2025-07273 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pamnamespace module of the Linux-PAM authentication module is caused by a...

Advisory ROSA-SA-2026-3157

Software: nghttp2 1.57.0 OS: ROSA Virtualization 3.1 unaffected versions = nghttp2-1.57.0-2.0.2.rv31 affected versions nghttp2-1.57.0-2.0.2.rv31 CVE-ID: CVE-2024-28182 BDU-ID: 2024-02691 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the nghttp2 library as part of the HTTP/2 protocol implementati...

Advisory ROSA-SA-2025-3103

Software: rsync 3.1.3 OS: ROSA Virtualization 2.1 packageevrstring: rsync-3.1.3-20.rv3 CVE-ID: CVE-2022-37434 BDU-ID: 2022-05325 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the inflate.c component of the zlib library is related to an operation exceeding buffer boundaries in memory...

Advisory ROSA-SA-2025-3053

Software: libarchive 3.3.3 OS: ROSA Virtualization 3.1 unaffected versions = libarchive-3.3.3.3-6.0.1.rv31 affected versions libarchive-3.3.3.3-6.0.1.rv31 CVE-ID: CVE-2025-5914 BDU-ID: CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the archivereadformatrarseekdata function of the Libarchive...

Advisory ROSA-SA-2025-2783

Software: libssh 0.9.6 OS: ROSA Virtualization 3.0 packageevrstring: libssh-0.9.6-14.rv30 CVE-ID: CVE-2023-6004 BDU-ID: 2024-00199 CVE-Crit: LOW CVE-DESC.: A vulnerability in the ProxyCommand/ProxyJump component of the libssh library is related to improper code generation controls. Exploitation o...

Advisory ROSA-SA-2025-2755

Software: pam 1.3.1 OS: ROSA Virtualization 2.1 packageevrstring: pam-1.3.1-36.rv3 CVE-ID: CVE-2024-10041 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in PAM allows an attacker to access sensitive information stored in memory through the execution of a victim program by sending...

Advisory ROSA-SA-2025-2746

Software: python3x-urllib3 1.25.10 OS: ROSA Virtualization 3.0 packageevrstring: python3x-urllib3-1.25.10-5.rv30 CVE-ID: CVE-2021-33503 BDU-ID: 2022-00586 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the HTTP client for Python urllib3 is related to uncontrolled resource consumption. Exploitation ...

Advisory ROSA-SA-2025-2739

Software: libvpx 1.7.0 OS: ROSA Virtualization 3.0 packageevrstring: libvpx-1.7.0-11.rv30 CVE-ID: CVE-2023-5217 BDU-ID: 2023-06157 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the VP8 format encoding function of the libvpx library of the Google Chrome browser is related to a buffer overflow ...

Advisory ROSA-SA-2024-2548

software: kubernetes 1.25.16 WASP: ROSA-CHROME packageevrstring: kubernetes-1.25.16-1 CVE-ID: CVE-2023-5528 BDU-ID: 2023-07938 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the kubelet utility of the Kubernetes virtual machine cluster management software tool is related to insufficient input...

Advisory ROSA-SA-2024-2502

Software: libndp 1.7 OS: ROSA Virtualization 2.1 packageevrstring: libndp-1.7-7.rv3 CVE-ID: CVE-2024-5564 BDU-ID: 2024-04337 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the libndp library is related to an operation exceeding buffer boundaries in memory. Exploitation of the vulnerability could...

Advisory ROSA-SA-2024-2500

Software: orc 0.4.28 OS: ROSA Virtualization 2.1 packageevrstring: orc-0.4.28-4.rv3 CVE-ID: CVE-2022-40897 BDU-ID: 2023-02445 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Python Packaging Authority package installation tools is related to insufficient input validation when processing HTML...

Advisory ROSA-SA-2024-2469

software: pcs 0.10.7 WASP: ROSA-CHROME packageevrstring: pcs-0.10.7-5 CVE-ID: CVE-2022-1049 BDU-ID: 2022-05543 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the corosync/pacemaker PCS program configuration utility is related to flaws in the authentication procedure. Exploitation of the vulnerabili...

Advisory ROSA-SA-2024-2462

Software: gstreamer1.0-plugins-good 1.19.1 OS: ROSA-CHROME packageevrstring: gstreamer1.0-plugins-good-1.19.1-4 CVE-ID: CVE-2022-2122 BDU-ID: 2022-06453 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the qtdemuxinflate function of the Gstreamer multimedia framework is caused by an integer overflow...

Advisory ROSA-SA-2024-2428

software: djvulibre 3.5.28 WASP: ROSA-CHROME packageevrstring: djvulibre-3.5.28-4 CVE-ID: CVE-2021-3500 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A flaw was discovered in djvulibre. A stack overflow in DJVU::DjVuDocument::getdjvufile via a created djvu file may cause the application to crash and...

Advisory ROSA-SA-2024-2416

Software: binutils 2.30 OS: ROSA Virtualization 2.1 packageevrstring: binutils-2.30-108.0.1.rv3.1 CVE-ID: CVE-2021-37322 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: GCC c++filt v2.26 was found to contain a post-release exploitation vulnerability via the cplus-dem.c component. CVE-STATUS: Not Relevant...

Advisory ROSA-SA-2024-2404

SOFTWARE: 389-ds-base 1.4.3.8 OS: ROSA Virtualization 2.1 packageevrstring: 389-ds-base-1.4.3.8.src.rpm CVE-ID: CVE-2022-1949 BDU-ID: 2022-04434 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the search filter ldbmsearch.c of the 389 Directory Server is related to access delimitation flaws...

Advisory ROSA-SA-2024-2376

Software: dav1d 1.3.0 AXIS: ROSA-CHROME packageevrstring: dav1d-1.3.0-1.src.rpm CVE-ID: CVE-2023-32570 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: VideoLAN dav1d has a threadtask.c race condition that could cause an application crash associated with dav1ddecodeframeexit. CVE-STATUS: Fixed CVE-REV: T...

Advisory ROSA-SA-2023-2276

software: librsvg 2.52.11 WASP: ROSA-CHROME packageevrstring: librsvg-2.52.11-1.src.rpm CVE-ID: CVE-2023-38633 BDU-ID: 2023-05427 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the XML document merge mechanism XInclude of the vector graphics rendering library librsvg is related to an incorrect...

Advisory ROSA-SA-2023-2225

software: pesign 116 WASP: ROSA-CHROME packageevrstring: pesign-116-1.src.rpm CVE-ID: CVE-2022-3560 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A flaw has been discovered in the design. The pesign package provides a systemd service used to run the pesign daemon. This service module runs a script to...

Advisory ROSA-SA-2023-2210

Software: opensmtpd 7.3.0p0rc2 OS: ROSA-CHROME packageevrstring: opensmtpd-7.3.0p0rc2-1.src.rpm CVE-ID: CVE-2023-29323 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: asciiloadsockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0.0-portable commi...

Advisory ROSA-SA-2021-1866

Software: libdwarf 20130207 OS: Cobalt 7.9 CVE-ID: CVE-2016-5028 CVE-Crit: MEDIUM CVE-DESC: The printframeinstbytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service dereferencing a null pointer via an object file with empty bss-like sections. CVE-STATUS:...

Advisory ROSA-SA-2021-1854

Software: imlib2 1.4.5 OS: Cobalt 7.9 CVE-ID: CVE-2011-5326 CVE-Crit: HIGH CVE-DESC: imlib2 before 1.4.9 allows remote attackers to cause a denial of service division-by-zero error and application crash by drawing a 2x1 ellipse. CVE-STATUS: default CVE-REV: default CVE-ID: CVE-2014-9762 CVE-Crit:...

Advisory ROSA-SA-2021-1850

Software: gstreamer 0.10.36 OS: Cobalt 7.9 CVE-ID: CVE-2016-10199 CVE-Crit: HIGH CVE-DESC: The qtdemuxtagaddstrfull function in gst / isomp4 / qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service read out of range and crash using a created...

Advisory ROSA-SA-2026-3305

CVE-ID: CVE-2016-10506 BDU-ID: None CVE-Crit: Medium CVE-DESCRIPTION: Vulnerabilities involving division by zero in functions opjpinextcprl, opjpinextpcrl, and opjpinextrpcl in the pi.c file of OpenJPEG allow a malicious attacker to cause a service failure abrupt termination of the application...

Advisory ROSA-SA-2026-3303

Component: libpano13 2.9.20 OS: ROSA-CHROME Unaffected versions: = libpano13-2.9.20-4 Affected versions: libpano13-2.9.20-4 CVE-ID: CVE-2021-33293 BDU-ID: None CVE-Crit: CRITICAL CVE-DESCRIPTION: A vulnerability exists in Panorama Tools libpano13 v2.9.20, specifically in the panoParserFindOLine...

Advisory ROSA-SA-2026-3302

Project: libid3tag 0.15.1b Operating System: ROSA-CHROME Unaffected versions: = libid3tag-0.15.1b-25 Affected versions: libid3tag-0.15.1b-25 CVE-ID: CVE-2004-2779 BDU-ID: None CVE-Crit: HIGH CVE-DESCRIPTION: A vulnerability exists in the id3utf16deserialize function in the utf16.c library of...

Advisory ROSA-SA-2026-3283

Software: libvncserver 0.9.13 OS: ROSA-CHROME unaffected versions = libvncserver-0.9.13-3 affected versions libvncserver-0.9.13-3 CVE-ID: CVE-2026-32853 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A read outside the heap buffer vulnerability in the UltraZip encoding handler in LibVNCServer allows a...

Advisory ROSA-SA-2026-3263

Software: kernel-ml 5.15.180 OS: rosa-server79 unaffected versions = kernel-ml-5.15.180-1.0.1.res7 affected versions kernel-ml-5.15.180-1.0.1.res7 CVE-ID: CVE-2026-31431 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Vulnerability in the Linux kernel crypto subsystem crypto: algifaead. Attempts to perfor...

Advisory ROSA-SA-2026-3256

software: libheif 1.12.0 WASP: ROSA-CHROME unaffected versions = libheif-1.12.0-6 affected versions libheif-1.12.0-6 CVE-ID: CVE-2025-68431 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: In libheif HEIF/AVIF decoder/encoder before 1.21.0, when processing a specially formed HEIF with an overlay element ...

Advisory ROSA-SA-2026-3254

software: coturn 4.5.2 OS: ROSA-CHROME unaffected versions = coturn-4.5.2-6 affected versions coturn-4.5.2-6 CVE-ID: CVE-2026-27624 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in Coturn allows a remote attacker to bypass loopback and internal IP range locking denied-peer-ip option and...