Advisory ROSA-SA-2025-2806

Software: krb5 1.18.2 OS: ROSA Virtualization 3.0 packageevrstring: krb5-1.18.2-31.0.1.rv30 CVE-ID: CVE-2024-37370 BDU-ID: 2024-07016 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the implementation of the Kerberos network authentication protocol is associated with a change to the public Extra Cou...

Advisory ROSA-SA-2025-2729

Software: opensc 0.20.0 OS: ROSA Virtualization 3.0 packageevrstring: opensc-0.20.0-8.rv30 CVE-ID: CVE-2023-2977 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in OpenSC causes a buffer overflow in the pkcs15 cardoshaveverifyrcpackage function, allowing an attacker to cause a processing...

Advisory ROSA-SA-2025-2711

Software: libxslt 1.1.32 OS: ROSA Virtualization 3.0 packageevrstring: libxslt-1.1.32 CVE-ID: CVE-2019-11068 BDU-ID: 2019-04263 CVE-Crit: CRITICAL. CVE-DESC.: An XSLT C vulnerability in the libxslt library is related to access control flaws. Exploitation of the vulnerability could allow an attack...

Advisory ROSA-SA-2025-2694

Software: samba 4.17.12 OS: ROSA Virtualization 3.0 packageevrstring: samba-4.17.12 CVE-ID: CVE-2022-38023 BDU-ID: 2022-06830 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Netlogon Remote Protocol MS-NRPC implementation of Windows operating systems is due to errors in security settings...

Advisory ROSA-SA-2025-2689

Software: scipy 1.0.0 OS: ROSA Virtualization 3.0 packageevrstring: scipy-1.0.0-21.0.2 CVE-ID: CVE-2023-29824 BDU-ID: 2024-07432 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the PyFindObjects function of the PyFindObjects library for the open source Python programming language scipy is relat...

Advisory ROSA-SA-2025-2670

software: runc 1.1.7 OS: ROSA-CHROME packageevrstring: runc-1.1.7 CVE-ID: CVE-2024-21626 BDU-ID: 2024-00973 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Runc isolated container launch tool is related to a flaw in the controlled area delimitations of the system. Exploitation of the vulnerabili...

Advisory ROSA-SA-2025-2666

software: postgresql 15.4 WASP: ROSA-CHROME packageevrstring: postgresql-15.4 CVE-ID: CVE-2023-5868 BDU-ID: 2023-07905 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the PostgreSQL database management system is related to the lack of service data protection in function calls with aggregation...

Advisory ROSA-SA-2025-2663

Software: sysstat 12.7.2 OS: ROSA-CHROME packageevrstring: sysstat-12.7.2 CVE-ID: CVE-2023-33204 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in sysstat allows an attacker to perform multiplication with integer overflow due to an incomplete fix for vulnerability CVE-2022-39377...

Advisory ROSA-SA-2025-2636

software: audiofile 0.3.6 OS: ROSA-CHROME packageevrstring: audiofile-0.3.6 CVE-ID: CVE-2015-7747 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Buffer overflow vulnerability in audiofile allows an attacker to cause a denial of service or execute arbitrary code through a specially crafted audio file...

Advisory ROSA-SA-2025-2562

Software: xerces-c 3.1.1 OS: rosa-server79 packageevrstring: xerces-c-3.1.1-10.0.1.res7 CVE-ID: CVE-2023-37536 BDU-ID: 2023-06960 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Heerces C++ library of the BigFix Platform IT Collaborative Management Platform is caused by an integer overflow...

Advisory ROSA-SA-2024-2546

software: tinyxml 2.6.2 OS: ROSA-CHROME packageevrstring: tinyxml-2.6.2-8 CVE-ID: CVE-2021-42260 BDU-ID: 2022-06895 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the TiXmlParsingData::Stamp function of the tinyxmlParser.cpp component of the TinyXML XML parser is related to the execution of a loop...

Advisory ROSA-SA-2024-2535

software: cacti 1.2.25 AXIS: ROSA-CHROME packageevrstring: cacti-1.2.25-2 CVE-ID: CVE-2023-46490 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A SQL injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the formactions function in managers.php. CVE-STATU...

Advisory ROSA-SA-2024-2528

Software: libspf2 1.2.11 OS: rosa-server79 packageevrstring: libspf2-1.2.11-11.20210922git4915c308.res7 CVE-ID: CVE-2021-20314 BDU-ID: 2021-04420 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the SPF protocol library libspf2 is related to an operation exceeding buffer boundaries in memory...

Advisory ROSA-SA-2021-1825

Software: dracut 033 OS: Cobalt 7.9 CVE-ID: CVE-2016-8637 CVE-Crit: HIGH CVE-DESC: A local information disclosure issue was discovered in dracut before 045 when generating initramfs images with read-only permissions for everyone when using 'Early cpio', such as when enabling microcode updates. A...

Advisory ROSA-SA-2026-3253

Software: haproxy 3.2.13 WASP: ROSA-CHROME unaffected versions = haproxy-3.2.13-1 affected versions haproxy-3.2.13-1 CVE-ID: CVE-2025-11230 BDU-ID: 2025-13169 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the HAProxy server software is related to algorithmic complexity. Exploitation of the...

Advisory ROSA-SA-2026-3237

software: libsndfile 1.1.0 OS: ROSA-CHROME unaffected versions = libsndfile-1.1.0-6 affected versions libsndfile-1.1.0-6 CVE-ID: CVE-2025-56226 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Memory leak in Libsndfile =1.2.2 in the mpegl3encoderinit function file mpegl3encode.c. CVE-STATUS: The...

Advisory ROSA-SA-2026-3233

software: libcupsfilters 2.0.0 OS: ROSA-CHROME unaffected versions = libcupsfilters-2.0.0.0-8 affected versions libcupsfilters-2.0.0-8 CVE-ID: CVE-2025-57812 BDU-ID: 2025-15977 CVE-Crit: LOW CVE-DESC.: A vulnerability in the cfFilterImageToRaster function of the CUPS print server is related to...

Advisory ROSA-SA-2026-3229

software: capstone 4.0.2 OS: ROSA-CHROME unaffected versions = capstone-4.0.2-2 affected versions capstone-4.0.2.2-2 CVE-ID: CVE-2025-67873 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC: Capstone is a disassembler framework. In versions up to and including 6.0.0.0-Alpha5, skipdata length was not checked...

Advisory ROSA-SA-2026-3226

software: grub2 2.06 WASP: ROSA-CHROME unaffected versions = grub2-2.06-26 affected versions grub2-2.06-26 CVE-ID: CVE-2025-61662 BDU-ID: 2025-14786 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the gettext module of the Grub2 operating systems boot loader is related to the ability to use memory...

Advisory ROSA-SA-2026-3220

Software: fonttools 4.49.0 WASP: ROSA-CHROME unaffected versions = fonttools-4.49.0-2 affected versions fonttools-4.49.0-2 CVE-ID: CVE-2025-66034 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Arbitrary file write vulnerability in fontTools varLib allows a remote attacker to execute arbitrary code when...

Advisory ROSA-SA-2026-3210

software: libssh 0.9.8 OS: ROSA-CHROME unaffected versions = libssh-0.9.8-3 affected versions libssh-0.9.8-3 CVE-ID: CVE-2025-5318 BDU-ID: 2025-09008 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the sftphandle function of the LibSSH library involves reading data outside of buffer boundaries in...

Advisory ROSA-SA-2026-3205

software: angie 1.11.3 OS: ROSA-CHROME unaffected versions = angie-1.11.3-1 affected versions angie-1.11.3-1 CVE-ID: CVE-2026-1642 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in NGINX OSS and NGINX Plus when proxying to upstream TLS servers allows an attacker in a man-in-the-middle...

Advisory ROSA-SA-2026-3193

Software: libtomcrypt 1.18.2 OS: ROSA Virtualization 2.1 unaffected versions = libtomcrypt-1.18.2-5.0.1.rv3 affected versions libtomcrypt-1.18.2-5.0.1.1.rv3 CVE-ID: CVE-2019-17362 BDU-ID: 2025-16070 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the derdecodeutf8string function of the...

Advisory ROSA-SA-2026-3204

Software: vim 8.0.1763 OS: ROSA Virtualization 2.1 unaffected versions = vim-8.0.1763-21.0.1.rv3 affected versions vim-8.0.1763-21.0.0.1.rv3 CVE-ID: CVE-2025-53905 BDU-ID: 2025-11730 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the vim text editor is related to an incorrect restriction of the...

Advisory ROSA-SA-2026-3194

Software: libtommath 1.1.0 OS: ROSA Virtualization 2.1 unaffected versions = libtommath-1.1.0-4.rv3 affected versions libtommath-1.1.0-4.rv3 CVE-ID: CVE-2023-36328 BDU-ID: 2023-06241 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the libtom function of the libtommath library is related to...

Advisory ROSA-SA-2026-3186

Software: vim 8.0.1763 OS: ROSA Virtualization 3.0 unaffected versions = vim-8.0.1763-21.0.1.1.rv30 affected versions vim-8.0.1763-21.0.0.1.rv30 CVE-ID: CVE-2025-53905 BDU-ID: 2025-11730 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the vim text editor is related to an incorrect restriction of t...

Advisory ROSA-SA-2026-3173

Software: libtomcrypt 1.18.2 OS: ROSA Virtualization 3.0 unaffected versions = libtomcrypt-1.18.2-5.0.1.rv30 affected versions libtomcrypt-1.18.2-5.0.1.rv30 CVE-ID: CVE-2019-17362 BDU-ID: 2025-16070 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the derdecodeutf8string function of the...

Advisory ROSA-SA-2026-3182

Software: sqlite 3.26.0 OS: ROSA Virtualization 3.0 unaffected versions = sqlite-3.26.0-20.rv30 affected versions sqlite-3.26.0-20.rv30 CVE-ID: CVE-2025-6965 BDU-ID: 2025-08786 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Aggregate Term Handler component of the SQLite database management syst...

Advisory ROSA-SA-2026-3179

Software: pam 1.3.1 OS: ROSA Virtualization 3.0 unaffected versions = pam-1.3.1-39.0.2.rv30 affected versions pam-1.3.1-39.0.2.rv30 CVE-ID: CVE-2025-6020 BDU-ID: 2025-07273 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pamnamespace module of the Linux-PAM authentication module is caused by a...

Advisory ROSA-SA-2026-3130

software: libxml2 2.9.14 OS: ROSA-CHROME unaffected versions = libxml2-2.9.14-12 affected versions libxml2-2.9.14-12 CVE-ID: CVE-2025-6021 BDU-ID: 2025-07144 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the xmlBuildQName function of the Libxml2 library is related to a stack-based buffer overflow...

Advisory ROSA-SA-2026-3128

software: gnutls 3.8.10 OS: ROSA-CHROME unaffected versions = gnutls-3.8.10-1 affected versions gnutls-3.8.10-1 CVE-ID: CVE-2025-32988 BDU-ID: 2025-11076 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the asn1deletestructure function of the GnuTLS transport layer security library involves a memory...

Advisory ROSA-SA-2026-3113

software: squid 5.9 WASP: ROSA-CHROME unaffected versions = squid-5.9-3 affected versions squid-5.9-3 CVE-ID: CVE-2023-49285 BDU-ID: 2023-08581 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Squid proxy server is related to an operation exceeding buffer boundaries in memory. Exploitation of the...

Advisory ROSA-SA-2025-3071

Software: libarchive 3.3.3 OS: ROSA Virtualization 3.0 unaffected versions = libarchive-3.3.3.3-6.0.1.rv30 affected versions libarchive-3.3.3.3-6.0.1.rv30 CVE-ID: CVE-2025-5914 BDU-ID: CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the archivereadformatrarseekdata function of the Libarchive...

Advisory ROSA-SA-2025-3061

Software: emacs 26.1 OS: ROSA Virtualization 2.1 unaffected versions = emacs-26.1-15.rv3 affected versions emacs-26.1-15.rv3 CVE-ID: CVE-2024-53920 BDU-ID: CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the elisp-completion-at-point and elisp-flymake-byte-compile function of the ELisp mode of...

Advisory ROSA-SA-2025-2997

software: curl 8.7.1 OS: ROSA-CHROME unaffected versions = curl-8.7.1-4 affected versions curl-8.7.1-4 CVE-ID: CVE-2024-11053 BDU-ID: 2024-11106 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the netrc file handler of the cURL command line utility is related to insufficient protection of servic...

Advisory ROSA-SA-2025-2920

software: freerdp 2.11.7 OS: ROSA-CHROME unaffected versions = freerdp-2.11.7-7 affected versions freerdp-2.11.7-7 CVE-ID: CVE-2024-32661 BDU-ID: 2024-03394 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the FreeRDP RDP client is related to null pointer dereferencing. Exploitation of the...

Advisory ROSA-SA-2025-2874

Software: java-1.8.0-openjdk 1.8.0.442.b06 OS: rosa-server79 packageevrstring: java-1.8.0-openjdk-1.8.0.442.b06-1.0.3.res7 CVE-ID: CVE-2025-21587 BDU-ID: 2025-05070 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the JSSE component of the Oracle Java SE software platform, Oracle GraalVM for JDK and...

Advisory ROSA-SA-2025-2844

Software: gtk3 3.22.30 OS: ROSA Virtualization 2.1 packageevrstring: gtk3-3.22.30-12.rv3 CVE-ID: CVE-2024-6655 BDU-ID: 2024-06447 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the GTK graphical user interface creation library GIMP Toolkit is related to mismanagement of code generation...

Advisory ROSA-SA-2025-2807

Software: less 530 OS: ROSA Virtualization 3.0 packageevrstring: less-530-3.rv30 CVE-ID: CVE-2022-48624 BDU-ID: 2024-04438 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the closealtfile filename.c function for UNIX-like Less text terminals is related to the skipping of Shellquote calls for...

Advisory ROSA-SA-2025-2802

Software: grub2 2.02 OS: ROSA Virtualization 3.0 packageevrstring: grub2-2.02-156.0.3.rv30 CVE-ID: CVE-2023-4692 BDU-ID: 2023-06822 CVE-Crit: LOW CVE-DESC.: A vulnerability in the fs/ntfs.c component of the Grub2 operating systems boot loader is related to a buffer overflow in dynamic memory...

Advisory ROSA-SA-2025-2774

Software: kernel kernel OS: ROSA Virtualization 3.0 packageevrstring: kernel-kernel-4.18.0-553.40.1.el810 CVE-ID: CVE-2024-1086 BDU-ID: 2024-01187 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the nftverdictinit function in the net/netfilter/nftablesapi.c module of the Linux operating system...

Advisory ROSA-SA-2025-2712

Software: lz4 1.8.3 OS: ROSA Virtualization 3.0 packageevrstring: lz4-1.8.3-3.0.1 CVE-ID: CVE-2021-3520 BDU-ID: 2021-05259 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the memmove function of the LZ4 lossless data compression algorithm is related to an operation exceeding the allowable data buffe...

Advisory ROSA-SA-2025-2696

Software: systemd 239 OS: ROSA Virtualization 3.0 packageevrstring: systemd-239-78.0.1 CVE-ID: CVE-2019-3843 BDU-ID: 2022-00318 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the systemd service initialization and management subsystem is related to improper privilege assignment. Exploitation of...

Advisory ROSA-SA-2025-2685

Software: nettle 3.4.1 OS: ROSA Virtualization 3.0 packageevrstring: nettle-3.4.1-7 CVE-ID: CVE-2021-20305 BDU-ID: 2021-02748 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the signature verification functions GOST DSA, EDDSA, and ECDSA of the Nettle library is related to flaws in the cryptographic...

Advisory ROSA-SA-2025-2659

software: openslp 2.0.0 WASP: ROSA-CHROME packageevrstring: openslp-2.0.0 CVE-ID: CVE-2016-4912 BDU-ID: None CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in OpenSLP allows remote attackers to cause a denial of service via a large number of specially crafted packets. CVE-STATUS: The vulnerability...

Advisory ROSA-SA-2025-2614

software: yt-dlp 2023.09.24 WASP: ROSA-CHROME packageevrstring: yt-dlp-2023.09.24-1 CVE-ID: CVE-2023-46121 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in yt-dlp allows an attacker to perform a MITM attack and gain access to a cookie. CVE-STATUS: The vulnerability has been resolved...

Advisory ROSA-SA-2025-2575

software: x11-server 1.20.14 OS: ROSA-CHROME packageevrstring: x11-server-1.20.14-11 CVE-ID: CVE-2024-9632 BDU-ID: 2024-09084 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the XkbSetCompatMap function of the X Window System X.Org Server implementation is related to a buffer overflow in dynamic...

Advisory ROSA-SA-2025-2554

Software: libcaca 0.99 OS: rosa-server79 packageevrstring: libcaca-0.99-0.40.beta20.res7 CVE-ID: CVE-2018-20545 BDU-ID: 2019-01073 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the loadimage src/common-image.c function of the libcaca graphics library involves an integer overflow. Exploitation of t...

Advisory ROSA-SA-2024-2542

Software: vorbis-tools 1.4.2 OS: ROSA-CHROME packageevrstring: vorbis-tools-1.4.2-3 CVE-ID: CVE-2023-43361 BDU-ID: 2024-02625 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Vorbis-tools package is related to the ability to write beyond buffer boundaries in memory when converting wav files to og...

Advisory ROSA-SA-2021-1871

Software: libgsf 1.14.26 OS: Cobalt 7.9 CVE-ID: CVE-2016-9888 CVE-Crit: MEDIUM CVE-DESC: A bug in the tardirectoryforfile function gsf-infile-tar.c in the GNOME structured file library before 1.14.41 can be used to trigger null pointer dereferencing and then crash through a created TAR file...