Vulnerabilities & updates
Sat, October 24
DSA-6583-1 libheif - security update
https://security-tracker.debian.org/tracker/DSA-6583-1
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) remove their private .filelock- link directories with shutil.rmtree (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable /proc/self/fd (a Linux path that names the process's own open f…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 When a soft-lock stale break finds that the marker (the lock file at ) it renamed aside was a live one recreated by a successor, the restore branch of break_lock_file() checks the break name with lstat (a check that reads a name without following a symbolic link) and then calls os.link(break_path, lock_file) by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a sha…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to /proc/self/fd/ , a Linux path that names the process's own open file n. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQL…
Fri, October 23
DSA-6579-1 roundcube - security update
https://security-tracker.debian.org/tracker/DSA-6579-1
DSA-6580-1 erlang - security update
https://security-tracker.debian.org/tracker/DSA-6580-1
DSA-6581-1 unbound - security update
https://security-tracker.debian.org/tracker/DSA-6581-1
DSA-6582-1 brotli - security update
https://security-tracker.debian.org/tracker/DSA-6582-1
USN-8954-1: zlib vulnerability
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution.
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
影響: npm:next >= 10.0.0, <= 15.5.27 → 15.5.28, npm:next >= 16.0.0, <= 16.4.0 → 16.4.1 A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
USN-8953-1: OpenVPN vulnerability
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Thu, October 22
USN-8952-1: Tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
Bun v1.4.4
Fixes 271 issues, addressing 544 👍. bun fmt, a Prettier-compatible formatter built into Bun that is 3x to 6x faster than oxfmt, bun check is 1.4x to 7.8x faster on large projects, bun install migrates Yarn Berry lockfiles, retries with exponential backoff and closes 133 issues, up to 3.2x faster hoisted installs from a warm cache on Linux, bun pm fetch, bun publish --recursive, packageExtensions, Bun.SQL uses up to 48% less CPU per query, query.cancel(), COPY streams, column name transforms, user-defined functions and update hooks in bun:sqlite, ws rewritten to behave like npm ws on Node.js,…
DSA-6534-3 webkit2gtk - regression update
https://security-tracker.debian.org/tracker/DSA-6534-3
DSA-6577-1 chromium - security update
https://security-tracker.debian.org/tracker/DSA-6577-1
DSA-6578-1 aide - security update
https://security-tracker.debian.org/tracker/DSA-6578-1
USN-8890-2: libsoup vulnerabilities
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 2…
USN-8951-1: c-ares vulnerabilities
It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-4904) It was discovered that c-ares did not properly limit DNS compression p…
USN-8947-1: NSS update
This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.
USN-8950-1: poppler vulnerability
It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.
USN-8930-2: U-Boot vulnerabilities
USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker…
USN-8949-1: Ghostscript vulnerabilities
Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (CVE-2026-101258) It was discovered that Ghostscript incorrectly handled memory when converting certain fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause Ghostscript to crash, or possibly ex…
USN-8948-2: PHP vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-20…
Wed, October 21
DSA-6573-1 firefox-esr - security update
https://security-tracker.debian.org/tracker/DSA-6573-1
DSA-6574-1 php8.4 - security update
https://security-tracker.debian.org/tracker/DSA-6574-1
DSA-6575-1 nginx - security update
https://security-tracker.debian.org/tracker/DSA-6575-1
DSA-6576-1 bind9 - security update
https://security-tracker.debian.org/tracker/DSA-6576-1
Tue, October 20
DSA-6572-1 ca-certificates - security update
https://security-tracker.debian.org/tracker/DSA-6572-1
SLES 15.6 repositories are being retired
The SLES 15.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL ZYPP archive .General support for SUSE Linux Enterprise Server (SLES) 15 SP6 (15.6) ended on December 31, 2025 (by upstream). All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. If you are still on SLES 15.6 either update to a newer SP (SP7 at the time of this writing), or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for…
RHEL 10.0 and 9.6 repositories are being retired
The RHEL 10.0 and RHEL 9.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL YUM archive . All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. The rolling EL-10 and EL-9 repository RPMs are not affected. If you are still on RHEL 10.0 or 9.6 (or on Rocky Linux / AlmaLinux 10.0 or 9.6), please either update to a newer minor release, or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for ea…
Sun, October 18
DSA-6567-2 cifs-utils - regression update
https://security-tracker.debian.org/tracker/DSA-6567-2
DSA-6570-1 haproxy - security update
https://security-tracker.debian.org/tracker/DSA-6570-1
DSA-6571-1 xen - security update
https://security-tracker.debian.org/tracker/DSA-6571-1
Fri, October 16
DSA-6565-1 spip - security update
https://security-tracker.debian.org/tracker/DSA-6565-1
DSA-6566-1 expat - security update
https://security-tracker.debian.org/tracker/DSA-6566-1
DSA-6567-1 cifs-utils - security update
https://security-tracker.debian.org/tracker/DSA-6567-1
DSA-6568-1 linux - security update
https://security-tracker.debian.org/tracker/DSA-6568-1
DSA-6569-1 apache2 - security update
https://security-tracker.debian.org/tracker/DSA-6569-1
containerd CRI plugin: Checkpoint restore bypasses destination security context
影響: go:github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.7 → 2.2.7, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.4 → 2.3.4 A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs, and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig. An attacker who can ru…
Introducing dotnetup: A toolchain manager for .NET
Learn how the new dotnetup tool helps macOS and Linux developers install, manage, and update user-local .NET SDKs and runtimes. The post Introducing dotnetup: A toolchain manager for .NET appeared first on .NET Blog .
Thu, October 15
DSA-6562-1 chromium - security update
https://security-tracker.debian.org/tracker/DSA-6562-1
DSA-6563-1 mutt - security update
https://security-tracker.debian.org/tracker/DSA-6563-1
DSA-6564-1 jpeg-xl - security update
https://security-tracker.debian.org/tracker/DSA-6564-1
Wed, October 14
DSA-6558-1 curl - security update
https://security-tracker.debian.org/tracker/DSA-6558-1
DSA-6559-1 buildstream - security update
https://security-tracker.debian.org/tracker/DSA-6559-1
DSA-6560-1 firefox-esr - security update
https://security-tracker.debian.org/tracker/DSA-6560-1
DSA-6561-1 sogo - security update
https://security-tracker.debian.org/tracker/DSA-6561-1
Wed, October 7
The Shift to cgroup v2 in Kubernetes: What You Need to Know
In Linux, cgroups (control groups) are a kernel feature used for managing system resources. Kubernetes uses cgroups to allocate resources like CPU and memory to containers, ensuring that applications run smoothly without interfering with each other. With the release of Kubernetes v1.31, support for v1 cgroup management moved into maintenance mode . Support for v2 cgroup management has been stable since Kubernetes v1.25. Compared with cgroup v1, cgroup v2 provides a single unified hierarchy, a more consistent interface, and a stronger foundation for resource isolation and modern resource-manag…
Tue, September 29
End of Life Announcement: Debian 11
On the 31st of August of this year (2026) Debian 11 "Bullseye" reached the end of its Long Term Support period, at which point we consider Bullseye to be End of Life. As we do not want to support our software running in unpatched environments, we have stopped building for Debian Bullseye. After the 1st of January 2027, we will start removing all repositories for this unsupported distribution from https://repo.powerdns.com/ . Users are recommended to upgrade their systems to supported operating system versions, such as Debian 12 or 13, or RHEL 9, 10, or any of the popular derivatives of RHEL.
Sat, September 26
runc v1.5.2 -- "Всё сбудется, стоит только расхотеть!"
This is the second patch release in the 1.5.z release series of runc, which primarily includes a workaround for a Linux kernel bug causing random runc crashes when using cgroup v2, and other fixes. Fixed runc exec -p with a process.json lacking env now sets HOME again (a regression in runc 1.3.0). ( #5265 , #5266 , #5459 ) Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2) which caused the kernel to write past the end of the structure provided by userspace (runc). This resulted in memory corruption inside runc (manifesting as random crashes) when configuring device r…