Advisory ROSA-SA-2025-2922

software: kanboard 1.2.44 AXIS: ROSA-CHROME unaffected versions = kanboard-1.2.44-0.gitc07304.1-rosa2021.1 affected versions kanboard-1.2.44-0.gitc07304.1-rosa2021.1 CVE-ID: CVE-2024-51748 BDU-ID: 2024-10653 CVE-Crit: HIGH CVE-DESC.: A vulnerability in Kanboard project management software is...

Advisory ROSA-SA-2025-2911

software: postgresql 12.22 WASP: ROSA-CHROME unaffected versions = postgresql-9.5.2 affected versions postgresql-9.5.2 CVE-ID: CVE-2016-2193 BDU-ID: 2016-00974 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the PostgreSQL database management system is related to errors in security settings...

Advisory ROSA-SA-2025-2894

Software: grub2 2.02 OS: rosa-server79 packageevrstring: grub2-2.02-0.87.0.3.res7.14 CVE-ID: CVE-2022-2601 BDU-ID: 2022-06819 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the grubfontconstructglyph function of the Grub2 operating systems boot loader is related to an operation exceeding buffer...

Advisory ROSA-SA-2025-2888

Software: jose 10 OS: ROSA Virtualization 3.0 packageevrstring: jose-10-2.rv30.3 CVE-ID: CVE-2023-50967 BDU-ID: 2024-02461 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the C language module for signing and encrypting JSON latchset Jose objects is associated with uncontrolled resource consumption...

Advisory ROSA-SA-2025-2887

Software: ghostscript 9.27 OS: ROSA Virtualization 3.0 packageevrstring: ghostscript-9.27-16.0.1.rv30 CVE-ID: CVE-2020-27792 BDU-ID: 2023-09076 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the lp8000printpage function of the gdevlp8k.c component of the Ghostscript document processing software...

Advisory ROSA-SA-2025-2885

Software: expat 2.2.5 OS: ROSA Virtualization 3.0 packageevrstring: expat-2.2.5-17.0.1.rv30 CVE-ID: CVE-2024-8176 BDU-ID: 2025-04573 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the libexpat XML file parsing library is related to a stack-based buffer overflow. Exploitation of the vulnerability...

Advisory ROSA-SA-2025-2893

Software: libtiff 4.0.9 OS: ROSA Virtualization 3.0 packageevrstring: libtiff-4.0.9-34.rv30 CVE-ID: CVE-2017-17095 BDU-ID: 2019-03339 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the LibTIFF library is related to a heap-based buffer overflow in TIFFSetupStrips. Exploitation of the vulnerability...

Advisory ROSA-SA-2025-2775

Software: c-ares 1.13.0 OS: ROSA Virtualization 2.1 packageevrstring: c-ares-1.13.0-11.rv3 CVE-ID: CVE-2020-22217 BDU-ID: 2023-05898 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the aresparsesoareply function of the C-ares asynchronous DNS query library is related to an operation exceeding...

Advisory ROSA-SA-2025-2760

Software: doxygen 1.8.5 OS: rosa-server79 packageevrstring: doxygen-1.8.5-4.0.1.res7 CVE-ID: CVE-2020-11022 BDU-ID: 2020-05190 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the jQuery library is associated with a failure to take measures to protect the structure of a web page. Exploitation of th...

Advisory ROSA-SA-2025-2680

Software: curl 7.61.1 OS: ROSA Virtualization 3.0 packageevrstring: curl-7.61.1-33.0.2 CVE-ID: CVE-2023-27533 BDU-ID: 2023-02107 CVE-Crit: LOW CVE-DESC.: A vulnerability in the curl program line utility is related to communication using the TELNET protocol, which could allow an attacker to pass a...

Advisory ROSA-SA-2025-2684

Software: libwebp 1.0.0 OS: ROSA Virtualization 3.0 packageevrstring: libwebp-1.0.0.0-8.0.1 CVE-ID: CVE-2018-25011 BDU-ID: 2021-03099 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the libwebp library for WebP image encoding and decoding is related to a buffer overflow in the "heap"...

Advisory ROSA-SA-2025-2686

Software: openldap 2.4.46 OS: ROSA Virtualization 3.0 packageevrstring: openldap-2.4.46-18.0.1 CVE-ID: CVE-2022-29155 BDU-ID: 2022-03203 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the OpenLDAP protocol implementation is related to failure to take measures to protect the SQL query structure...

Advisory ROSA-SA-2025-2565

software: mcpp 2.7.2 OS: ROSA-CHROME packageevrstring: mcpp-2.7.2-14 CVE-ID: CVE-2019-14274 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Heap-based buffer overflow vulnerability in MCPP in domsg in support.c. CVE-STATUS: The vulnerability has been resolved CVE-REV: To close the vulnerability, run the...

Advisory ROSA-SA-2025-2556

Software: cups-filters 1.0.35 OS: rosa-server79 packageevrstring: cups-filters-1.0.35-29.0.2.res7 CVE-ID: CVE-2024-47176 BDU-ID: 2024-07643 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the cups-browsed daemon of the CUPS print server is associated with the use of dangerous methods or functions...

Advisory ROSA-SA-2024-2540

software: wavpack 5.3.0 OS: ROSA-CHROME packageevrstring: wavpack-5.3.0-3 CVE-ID: CVE-2020-35738 BDU-ID: 2021-00777 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the WavpackPackSamples function of the packutils.c component of the WavPack audio codec is related to an operation exceeding the allowed...

Advisory ROSA-SA-2024-2534

software: zchunk 1.2.2 OS: ROSA-CHROME packageevrstring: zchunk-1.2.2.2-2 CVE-ID: CVE-2023-46228 BDU-ID: 2023-07324 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c components of the RPM zchunk file size reduction software...

Advisory ROSA-SA-2025-3011

software: postgresql 15.14 WASP: ROSA-CHROME unaffected versions = postgresql-15.14-1 affected versions postgresql-15.14-1 CVE-ID: CVE-2024-10979 BDU-ID: 2024-09679 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PL/Perl environment variables of the PostgreSQL database management system is relat...

Advisory ROSA-SA-2025-2979

software: ghostscript 9.56.1 OS: ROSA-CHROME unaffected versions = ghostscript-9.56.1-5 affected versions ghostscript-9.56.1-5 CVE-ID: CVE-2023-52722 BDU-ID: 2024-07479 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the afqkf psi/zmisc1.c file of the Ghostscript document processing, conversion,...

Advisory ROSA-SA-2025-2960

Software: ghostscript 9.27 OS: ROSA Virtualization 3.0 unaffected versions = ghostscript-9.27-17.0.3.rv30 affected versions ghostscript-9.27-17.0.3.rv30 CVE-ID: CVE-2020-16287 BDU-ID: 2021-01163 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the lprnisblack function contrib/lips4/gdevlprn.c of th...

Advisory ROSA-SA-2025-2953

PO: jose 14 WASP: ROSA-CHROME unaffected versions = jose-14-1 affected versions jose-14-1 CVE-ID: CVE-2023-50967 BDU-ID: 2024-02461 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the C language module for signing and encrypting JSON latchset Jose objects is associated with uncontrolled resource...

Advisory ROSA-SA-2025-2948

software: libsoup2.4 2.74.2 OS: ROSA-CHROME unaffected versions = libsoup2.4-2.74.2-2 affected versions libsoup2.4-2.74.2-2 CVE-ID: CVE-2025-32913 BDU-ID: 2025-06242 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the soupmessageheadersgetcontentdisposition function of the GNOME GUI libsoup library ...

Advisory ROSA-SA-2025-2947

software: libsoup 3.2.1 OS: ROSA-CHROME unaffected versions = libsoup-3.2.1-2 affected versions libsoup-3.2.1-2 CVE-ID: CVE-2025-32913 BDU-ID: 2025-06242 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the soupmessageheadersgetcontentdisposition function of the GNOME GUI libsoup library is related t...

Advisory ROSA-SA-2025-2945

software: curl 8.7.1 OS: ROSA-CHROME unaffected versions = curl-8.7.1-3 affected versions curl-8.7.1-3 CVE-ID: CVE-2025-0725 BDU-ID: 2025-01585 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the gzipdowrite function of the zlib compression library of the cURL command line utility is related to...

Advisory ROSA-SA-2025-2936

software: ghostscript 9.56.1 OS: ROSA-CHROME unaffected versions = ghostscript-9.56.1-4 affected versions ghostscript-9.56.1-4 CVE-ID: CVE-2024-29507 BDU-ID: 2024-05697 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Ghostscript document processing, conversion, and generation software suite is...

Advisory ROSA-SA-2025-2935

software: upx 5.0.0 WASP: ROSA-CHROME unaffected versions = upx-5.0.0.0-1 affected versions upx-5.0.0-1 CVE-ID: CVE-2025-2849 BDU-ID: 2025-06969 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the PackLinuxElf64::unDTINIT function of the src/plxelf.cpp file of the UPX executable file packer is...

Advisory ROSA-SA-2025-2927

Software: corosync 3.1.9 OS: ROSA-CHROME unaffected versions = corosync-3.1.9-2 affected versions corosync-3.1.9-2 CVE-ID: CVE-2025-30472 BDU-ID: 2025-03217 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the orftokenendianconvert function of the Corosync group communication system for fault-toleran...

Advisory ROSA-SA-2025-2928

software: expat 2.7.1 OS: ROSA-CHROME unaffected versions = expat-2.7.1-1 affected versions expat-2.7.1-1 CVE-ID: CVE-2024-45490 BDU-ID: 2024-07004 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the libexpat XML parsing library is related to an improper restriction of a reference to an external...

Advisory ROSA-SA-2025-2916

software: xwayland 24.1.6 WASP: ROSA-CHROME unaffected versions = xwayland-24.1.6-1 affected versions xwayland-24.1.6-1 CVE-ID: CVE-2025-26594 BDU-ID: 2025-04129 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Wayland protocol implementation for X.Org XWayland, an implementation of the X Windo...

Advisory ROSA-SA-2025-2912

software: mosquitto 2.0.20 WASP: ROSA-CHROME unaffected versions = mosquitto-2.0.20-1 affected versions mosquitto-2.0.20-1 CVE-ID: CVE-2024-3935 BDU-ID: 2024-09880 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Eclipse Mosquitto message broker is related to memory re-release. Exploitation of th...

Advisory ROSA-SA-2025-2863

Software: kernel 4.18.0 OS: ROSA Virtualization 3.0 packageevrstring: kernel-4.18.0-553.40.1.el810 CVE-ID: CVE-2024-40998 BDU-ID: None CVE-Crit: DATA LOSSES. CVE-DESC.: Vulnerability in Linux kernel: access to uninitialized rs-lock lock in ext4fillsuper function. CVE-STATUS: Vulnerability has bee...

Advisory ROSA-SA-2025-2829

Software: postgresql-jdbc 42.2.28 OS: ROSA Virtualization 3.0 packageevrstring: postgresql-jdbc-42.2.28-1.0.1.rv30 CVE-ID: CVE-2024-1597 BDU-ID: 2024-01541 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the JDBC driver pgjdbc for connecting Java programs to a PostgreSQL database is related to...

Advisory ROSA-SA-2025-2799

Software: gdk-pixbuf2 2.36.12 OS: ROSA Virtualization 3.0 packageevrstring: gdk-pixbuf2-2.36.12-6.0.1.rv30 CVE-ID: CVE-2022-48622 BDU-ID: 2024-06670 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the GdkPixbuf image loading library is related to a heap memory corruption in aniloadchunk. Exploitatio...

Advisory ROSA-SA-2025-2766

Software: rsync 3.1.3 OS: ROSA Virtualization 3.0 packageevrstring: rsync-3.1.3-20.rv30 CVE-ID: CVE-2024-12085 BDU-ID: 2025-00376 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the rsyncd daemon of the Rsync file transfer and synchronization utility is related to an operation exceeding buffer...

Advisory ROSA-SA-2025-2767

Software: libsoup 2.62.3 OS: ROSA Virtualization 3.0 packageevrstring: libsoup-2.62.3-7.rv30 CVE-ID: CVE-2024-52530 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An HTTP request smuggling vulnerability in GNOME libsoup allows an attacker to trick the server by injecting the '\0' character into request...

Advisory ROSA-SA-2025-2758

Software: libsoup 2.62.2 OS: rosa-server79 packageevrstring: libsoup-2.62.2-2.0.3.res7 CVE-ID: CVE-2024-52531 BDU-ID: 2025-00232 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the soupheaderparseparamliststrict function of the GNOME GUI libsoup library is related to a buffer overflow in dynamic...

Advisory ROSA-SA-2025-2761

Software: raptor2 2.0.9 OS: rosa-server79 packageevrstring: raptor2-2.0.9-3.0.1.res7 CVE-ID: CVE-2024-57823 BDU-ID: None CVE-Crit: CRITICAL. CVE-DESC.: An integer overflow vulnerability was discovered in the Raptor RDF Syntax Library when normalizing URIs using the turtle parser in the...

Advisory ROSA-SA-2025-2737

Software: iperf3 3.5 OS: ROSA Virtualization 3.0 packageevrstring: iperf3-3.5-10.rv30 CVE-ID: CVE-2023-7250 BDU-ID: 2024-03238 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the Iperf3 network bandwidth measurement tool is related to allowed input lists. Exploitation of the vulnerability could...

Advisory ROSA-SA-2025-2731

Software: PackageKit 1.1.12 OS: ROSA Virtualization 3.0 packageevrstring: PackageKit-1.1.12-7.0.1.rv30 CVE-ID: CVE-2024-0217 BDU-ID: None CVE-Crit: LOW CVE-DESC.: A use-after-free vulnerability in PackageKitd allows an attacker to access freed memory and potentially execute arbitrary code...

Advisory ROSA-SA-2025-2697

Software: tomcat 9.0.62 OS: ROSA Virtualization 3.0 packageevrstring: tomcat-9.0.62-30.0.2 CVE-ID: CVE-2022-29885 BDU-ID: 2022-03434 CVE-Crit: HIGH CVE-DESC.: An implementation vulnerability in the EncryptInterceptor class of the Apache Tomcat application server is related to incomplete program...

Advisory ROSA-SA-2025-2693

Software: pcre2 10.34 OS: ROSA Virtualization 3.0 packageevrstring: pcre2-10.34-9.0.3 CVE-ID: CVE-2022-1586 BDU-ID: 2022-03770 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the compilexclassmatchingpath function of the PCRE2 library is related to reading data beyond buffer boundaries in memory...

Advisory ROSA-SA-2025-2687

Software: pango 1.42.4 OS: ROSA Virtualization 3.0 packageevrstring: pango-1.42.4-8 CVE-ID: CVE-2019-1010238 BDU-ID: 2019-02871 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the pangolog2visgetembeddinglevels function of the Pango library is related to an operation exceeding buffer boundaries...

Advisory ROSA-SA-2025-2667

software: sqlite 3.41.2 OS: ROSA-CHROME packageevrstring: sqlite-3.41.2-2 CVE-ID: CVE-2023-7104 BDU-ID: 2024-00480 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the sessionReadRecord function of the ext/session/sqlite3session.c file of the SQLite database management system is related to a buffer...

Advisory ROSA-SA-2025-2598

software: glib2.0 2.72.3 OS: ROSA-CHROME packageevrstring: glib2.0-2.72.3-4 CVE-ID: CVE-2023-29499 BDU-ID: 2023-07646 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the isnormal function of the Glib library is associated with uncontrolled resource consumption. Exploitation of the vulnerability coul...

Advisory ROSA-SA-2025-2590

software: vim 9.1.0754 WASP: ROSA-CHROME packageevrstring: vim-9.1.0754-1 CVE-ID: CVE-2024-41957 BDU-ID: 2024-06478 CVE-Crit: LOW CVE-DESC.: A vulnerability in the tagstackclearentry function of the src/alloc.c file of the vim text editor exists due to a bug in the use of pointers after memory...

Advisory ROSA-SA-2025-2583

Software: libarchive 3.6.2 OS: ROSA-CHROME packageevrstring: libarchive-3.6.2 CVE-ID: CVE-2024-48957 BDU-ID: 2024-09446 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the executefilteraudio function of the archivereadsupportformatrar.c component of the Libarchive archiving library is related to...

Advisory ROSA-SA-2025-2566

software: x11-server 1.20.14 OS: ROSA-CHROME packageevrstring: x11-server-1.20.14-6 CVE-ID: CVE-2023-6377 BDU-ID: 2024-00457 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the xorg-x11-server package is related to the use of memory after it has been freed when processing Button Action objects...

Advisory ROSA-SA-2025-2558

Software: libsoup 2.62.2 OS: rosa-server79 packageevrstring: libsoup-2.62.2-2.0.1.res7 CVE-ID: CVE-2024-52530 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Vulnerability in GNOME libsoup allows HTTP request smuggling attack due to ignoring '\0' characters at the end of header names. CVE-STATUS: The...

Advisory ROSA-SA-2025-2959

Software: avahi 0.7 OS: ROSA Virtualization 2.1 unaffected versions = avahi-0.7-27.0.2.rv3.1 affected versions avahi-0.7-27.0.2.2.rv3.1 CVE-ID: CVE-2017-6519 BDU-ID: 2019-00693 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the avahi-daemon daemon of the Avahi local area network service...

Advisory ROSA-SA-2025-2938

software: emacs 30.1 OS: ROSA-CHROME unaffected versions = emacs-30.1-1 affected versions emacs-30.1-1 CVE-ID: CVE-2024-30202 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Vulnerability in Emacs allows execution of arbitrary Lisp code when Org mode is activated. CVE-STATUS: The vulnerability has been...

Advisory ROSA-SA-2025-2932

software: libheif 1.12.0 WASP: ROSA-CHROME unaffected versions = libheif-1.12.0-5 affected versions libheif-1.12.0-5 CVE-ID: CVE-2024-25269 BDU-ID: 2024-03241 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the JpegEncoder::Encode function of the libheif decoder and file format encoder is related to...