Tuxcare Errata System 0.0.1 5.10 2026-10-05T22:47:19 TuxCare 9.8 - CVE-2026-42217: reject IDManifest variable-length integers whose shift reaches 64 bits, avoiding undefined behaviour in readVariableLengthInteger() Critical TuxCare License Agreement CVE-2026-42217 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-32775: buffer overwrite via underflow in exif_mnote_data_get_value() Important TuxCare License Agreement CVE-2026-32775 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-32316: heap overflow in jvp_string_append/copy_replace_bad() - CVE-2026-49839: heap out-of-bounds write in jv_load_file() (--rawfile) Important TuxCare License Agreement CVE-2026-49839 CVE-2026-32316 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-6276: cookie leak via stale custom Host cookiehost on handle reuse Important TuxCare License Agreement CVE-2026-6276 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2025-24912: drop a pending RADIUS request from the retransmit list only after a handler has accepted the response, so an injected response with a matching identifier cannot cancel a legitimate pending request Important TuxCare License Agreement CVE-2026-58374 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2023-45853: reject zip header fields longer than 65535 bytes in minizip's zipOpenNewFileInZip4_64() to avoid an integer overflow and heap buffer overflow Critical TuxCare License Agreement CVE-2023-45853 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - Add Alma9_8ESU; carry the tuxcare9.6esu CVE fixes - CVE-2025-27830: fix potential buffer overflow with DollarBlend in font serialization - CVE-2025-27831: prevent Unicode decoding overrun in txtwrite/docxwrite devices - CVE-2025-27835: fix confusion between bytes and shorts in glyph to Unicode conversion - CVE-2025-27836: fix potential print buffer overflow in BJ10V device - CVE-2024-29508: fix heap-based pointer disclosure in pdf_base_font_alloc - CVE-2025-48708: fix argument sanitization to redact values supplied with '#' separator - CVE-2024-46955: out-of-bounds read when reading a color in Indexed color space - CVE-2025-59798: buffer overrun in pdf_write_cmap in the pdfwrite device - CVE-2025-59799: stack buffer overflow in pdfmark_coerce_dest in the pdfwrite device - CVE-2023-52722: reject non-standard eexec seeds in SAFER mode (psi/zmisc1.c) Moderate TuxCare License Agreement CVE-2025-27830 CVE-2024-46955 CVE-2025-27835 CVE-2023-52722 CVE-2024-29508 CVE-2025-59799 CVE-2025-27836 CVE-2025-48708 CVE-2025-59798 CVE-2025-27831 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-40468: fix integer overflow of the result-buffer offset in do_sub() - CVE-2026-40469: fix integer overflow of the result-buffer size in do_sub() on 32-bit builds Critical TuxCare License Agreement CVE-2026-40469 CVE-2026-40468 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2025-69720: stack buffer overflow in infocmp analyze_string() Important TuxCare License Agreement CVE-2025-69720 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2023-35945: memory leak in nghttp2_session_mem_send_internal() Important TuxCare License Agreement CVE-2023-35945 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2025-52194: undefined float-to-int conversion in ircam_read_header() Important TuxCare License Agreement CVE-2025-52194 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-3731: heap out-of-bounds read in sftp_extensions_get_name/data() Important TuxCare License Agreement CVE-2026-3731 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-60000: pre-auth resource exhaustion in input_gssapi_errtok(), GSSAPI error tokens were not counted against MaxAuthTries Important TuxCare License Agreement CVE-2026-60000 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-18924: link HTTP/2 server-push transfers to the parent handle's share in duphandle() so the pushed handle does not outlive shared state Important TuxCare License Agreement CVE-2026-18924 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-5773: wrong SMB connection reuse across shares - CVE-2026-8458: stale Negotiate service name on reused connections - CVE-2026-8932: connection reuse ignoring mTLS private key options Important TuxCare License Agreement CVE-2025-15079 CVE-2026-8932 CVE-2026-8458 CVE-2026-5773 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2023-4504: heap buffer over-read in scan_ps() on a trailing backslash Important TuxCare License Agreement CVE-2023-4504 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-40528: buffer overflow in do_key_value() on long profile key values Important TuxCare License Agreement CVE-2026-40528 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-50292: udev property injection via phys in libinput-device-group Critical TuxCare License Agreement CVE-2026-50292 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-72712: infinite loop in Packet:parse_options() on zero-length option Important TuxCare License Agreement CVE-2026-72712 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - Add Alma9_8ESU; carry the tuxcare9.6esu CVE fixes - CVE-2024-49394: protect In-Reply-To and References under the cryptographic signature (add to protected headers) - CVE-2024-49395: fix missing display of encryption recipients in GPGME - CVE-2026-43859: use memcpy() instead of strfcpy() in hmac_md5() so a binary MD5 digest of an over-long IMAP CRAM-MD5 secret is not truncated at an embedded NUL - CVE-2026-43860: copy the full MD5_DIGEST_LEN bytes of the hashed IMAP CRAM-MD5 secret in hmac_md5() instead of one byte less - CVE-2026-43861: reject a percent-encoded NUL (%00) as an invalid character in url_pct_decode() - CVE-2026-43862: check that the GSSAPI security-level token is at least 4 bytes before reading it in imap_auth_gss(), and read it as uint32_t - CVE-2026-43863: treat a negative gpgme_data_read() return as an error in data_object_to_stream() instead of looping forever - CVE-2026-43864: check key and key->subkeys for NULL in show_sig_summary() Moderate TuxCare License Agreement CVE-2026-43862 CVE-2024-49394 CVE-2026-43863 CVE-2026-43860 CVE-2024-49395 CVE-2026-43859 CVE-2026-43861 CVE-2026-43864 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - Rebase to 5.1.0-6.el9_8.1; vendor Patch005/006 carry the upstream fixes for CVE-2026-40468 and CVE-2026-40469 (our patches dropped) - CVE-2023-4156: fix heap out-of-bounds read in format_tree() in builtin.c Important TuxCare License Agreement CVE-2023-4156 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - Add Alma9_8ESU; carry the tuxcare9.6esu CVE fixes - CVE-2023-7207: path traversal via absolute symlink targets under --no-absolute-filenames; drop cpio-2.13-revert-CVE-2015-1197-fix.patch and apply the upstream symlink-placeholder fix instead - CVE-2026-66485: avoid stack exhaustion from archive-controlled paths - CVE-2026-66486: quote file names in diagnostics and listings Moderate TuxCare License Agreement CVE-2023-7207 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2023-51257: out-of-bounds write in jas_icctxt_input() - CVE-2025-8836: reachable assertion in jpc_floorlog2() via cp_create() - CVE-2025-8837: use-after-free in jpc_dec_dump() Important TuxCare License Agreement CVE-2025-8836 CVE-2023-51257 CVE-2025-8837 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2025-10921: fix HDR file parsing heap-based buffer overflow vulnerability; bound linesize by the size of one scanline and correct the run length check added for CVE-2026-2050 Important TuxCare License Agreement CVE-2025-10921 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-14199: auth proxy cache key collision in getProxyCacheKey() - Stop exporting GOEXPERIMENT=boringcrypto: golang 1.26.7-2.el9_8 defaults to GOFIPS140=certified and refuses the experiment Important TuxCare License Agreement CVE-2026-14199 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2025-12495, CVE-2025-12839, CVE-2025-12840: heap buffer overflows in OpenEXRCore chunk reading (memset on a failed read in exr_read_chunk(), packed/unpacked size mismatch of uncompressed tiles, tiled chunk sizes for scanline parts in internal_exr_compute_chunk_offset_size()) Important TuxCare License Agreement CVE-2025-12840 CVE-2025-12495 CVE-2025-12839 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-42960: in scrub_normalize(), mark additional-section glue as allowed only for NS rrsets in the authority section, so address records can no longer be cached as a side effect of a delegation response - CVE-2026-80225: bound the number of pipelined queries drained from one TCP/DoT connection per event-loop visit to NUM_TCP_PER_SELECT and defer the remainder through a zero-delay timer, so a single connection can no longer monopolise a worker event loop - CVE-2026-85501: add the val-validation-attempts and val-hash-attempts limits (default 32 each) to bound DNSSEC signature and hash work per validation, and require only the answer and authority sections to be secure (reply_an_ns_rrsets_secure), so the additional section is no longer validated Critical TuxCare License Agreement CVE-2026-80225 CVE-2026-85501 CVE-2026-42960 CVE-2026-81634 CVE-2026-81642 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-25210: add an integer overflow check before the tag buffer doubling in doContent(), so the reallocation size can no longer wrap - CVE-2026-56407: cap the entity value pool length against signed integer overflow in doProlog() before it is stored into m_declEntity->textLen - CVE-2026-56408: add the upstream integer overflow guard to copyString(); with XML_Char == char as built here the guard is inert, and it takes effect only in an XML_UNICODE build where sizeof(XML_Char) > 1 Critical TuxCare License Agreement CVE-2026-56131 CVE-2026-56408 CVE-2026-25210 CVE-2026-66046 CVE-2026-56407 CVE-2026-76957 CVE-2026-93990 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2024-41123: rexml: fix ReDoS in REXML::Source when parsing input with many >]/]]> sequences or without a terminator - CVE-2024-41946: rexml: enforce the entity expansion limit in the SAX2 and pull parsers - CVE-2024-43398: rexml: fix DoS in the tree parser on deep elements with same-local-name namespaced attributes (the affected bundled rexml 3.2.5 parser/source files are synced with rexml 3.3.9, which carries these fixes and their prerequisites) - CVE-2025-58767: rexml: fix DoS when parsing XML with multiple XML declarations; only one well-formed XML declaration is accepted Critical TuxCare License Agreement CVE-2026-27820 CVE-2025-58767 CVE-2025-27221 CVE-2025-61594 CVE-2026-42257 CVE-2024-43398 CVE-2024-41946 CVE-2024-41123 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-21637: uncaught exception from SNICallback in loadSNI() crashes the TLS server Critical TuxCare License Agreement CVE-2026-48930 CVE-2026-21637 CVE-2026-21710 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 TuxCare 9.8 - CVE-2026-54679: integer overflow in jvp_string_append() on 32-bit Moderate TuxCare License Agreement CVE-2026-54679 cpe:/o:almalinux:almalinux:9::baseos cpe:/o:resf:rocky_linux:9.8 /etc/tuxcare-release TuxCare Enterprise Support for .* release 9\.8 1 openexr openexr-devel openexr-libs libexif libexif-devel libexif-doc jq jq-devel curl curl-minimal libcurl libcurl-devel libcurl-minimal hostapd hostapd-logwatch minizip-compat minizip-compat-devel zlib zlib-devel zlib-static ghostscript ghostscript-doc ghostscript-gtk ghostscript-tools-dvipdf ghostscript-tools-fonts ghostscript-tools-printing ghostscript-x11 libgs libgs-devel gawk gawk-all-langpacks gawk-devel gawk-doc ncurses ncurses-base ncurses-c++-libs ncurses-compat-libs ncurses-devel ncurses-libs ncurses-static ncurses-term libnghttp2 libnghttp2-devel nghttp2 libsndfile libsndfile-devel libsndfile-utils libssh libssh-config libssh-devel openssh openssh-askpass openssh-clients openssh-keycat openssh-server openssh-sk-dummy pam_ssh_agent_auth cups cups-client cups-devel cups-filesystem cups-ipptool cups-libs cups-lpd cups-printerapp opensc libinput libinput-devel libinput-test libinput-utils nmap nmap-ncat mutt cpio jasper jasper-devel jasper-libs jasper-utils gegl04 gegl04-devel gegl04-devel-docs gegl04-tools grafana grafana-selinux python3-unbound unbound unbound-devel unbound-dracut unbound-libs expat expat-devel expat-static ruby ruby-default-gems ruby-devel ruby-doc ruby-libs rubygem-bigdecimal rubygem-bundler rubygem-io-console rubygem-irb rubygem-json rubygem-minitest rubygem-power_assert rubygem-psych rubygem-rake rubygem-rbs rubygem-rdoc rubygem-rexml rubygem-rss rubygem-test-unit rubygem-typeprof rubygems rubygems-devel nodejs nodejs-devel nodejs-docs nodejs-full-i18n nodejs-libs npm v8-devel D36CB86CB86B3716 d07bf2a08d50eb66 aarch64|i686|x86_64 0:3.1.1-3.el9_8.4.tuxcare.els1 aarch64|i686|x86_64 0:0.6.22-6.el9_8.1.tuxcare.els1 aarch64|i686|x86_64 0:1.6-19.el9_8.2.tuxcare.els1 aarch64|i686|x86_64 0:7.76.1-40.el9_8.7.tuxcare.els1 aarch64|i686|x86_64 0:2.11-2.el9.tuxcare.els2 aarch64|i686|x86_64 0:1.2.11-40.el9.tuxcare.els1 aarch64|i686|x86_64 0:9.54.0-19.el9_6.tuxcare.els6 0:9.54.0-19.el9_6.tuxcare.els6 aarch64|i686|x86_64 0:5.1.0-6.el9.tuxcare.els1 0:5.1.0-6.el9.tuxcare.els1 aarch64|i686|x86_64 0:6.2-12.20210508.el9.tuxcare.els1 0:6.2-12.20210508.el9.tuxcare.els1 aarch64|i686|x86_64 0:1.43.0-6.el9_8.2.tuxcare.els1 aarch64|i686|x86_64 0:1.0.31-9.el9_8.1.tuxcare.els1 aarch64|i686|x86_64 0:0.10.4-19.el9_8.tuxcare.els1 0:0.10.4-19.el9_8.tuxcare.els1 aarch64|i686|x86_64 0:9.9p1-11.el9_8.tuxcare.els1 aarch64|i686|x86_64 0:0.10.4-8.11.el9_8.tuxcare.els1 aarch64|i686|x86_64 0:7.76.1-40.el9_8.7.tuxcare.els4 aarch64|i686|x86_64 0:7.76.1-40.el9_8.7.tuxcare.els3 aarch64|i686|x86_64 1:2.3.3op2-39.el9_8.tuxcare.els1 1:2.3.3op2-39.el9_8.tuxcare.els1 aarch64|i686|x86_64 0:0.23.0-6.el9.tuxcare.els1 aarch64|i686|x86_64 0:1.19.3-8.el9_7.tuxcare.els1 aarch64|i686|x86_64 3:7.92-5.el9.tuxcare.els1 aarch64|i686|x86_64 5:2.2.6-2.el9.tuxcare.els4 aarch64|i686|x86_64 0:5.1.0-6.el9_8.1.tuxcare.els1 0:5.1.0-6.el9_8.1.tuxcare.els1 aarch64|i686|x86_64 0:2.13-16.el9.tuxcare.els3 aarch64|i686|x86_64 0:2.0.28-4.el9.tuxcare.els1 aarch64|i686|x86_64 0:0.4.62-1.el9_8.2.tuxcare.els1 aarch64|x86_64 0:10.2.6-23.el9_8.3.tuxcare.els1 aarch64|i686|x86_64 0:3.1.1-3.el9_8.4.tuxcare.els2 aarch64|i686|x86_64 0:1.24.2-3.el9_8.8.tuxcare.els1 aarch64|i686|x86_64 0:2.5.0-6.el9_8.5.tuxcare.els1 aarch64|i686|x86_64 0:3.0.7-168.el9_8.tuxcare.els2 0:3.0.7-168.el9_8.tuxcare.els2 aarch64|i686|x86_64 0:3.0.0-168.el9_8.tuxcare.els2 0:2.2.33-168.el9_8.tuxcare.els2 aarch64|i686|x86_64 0:0.5.7-168.el9_8.tuxcare.els2 0:1.3.5-168.el9_8.tuxcare.els2 aarch64|i686|x86_64 0:2.5.1-168.el9_8.tuxcare.els2 0:5.14.2-168.el9_8.tuxcare.els2 0:1.2.1-168.el9_8.tuxcare.els2 aarch64|i686|x86_64 0:3.3.2-168.el9_8.tuxcare.els2 0:13.0.3-168.el9_8.tuxcare.els2 0:1.4.0-168.el9_8.tuxcare.els2 0:6.3.4.1-168.el9_8.tuxcare.els2 0:3.2.5-168.el9_8.tuxcare.els2 0:0.2.9-168.el9_8.tuxcare.els2 0:3.3.7-168.el9_8.tuxcare.els2 0:0.15.2-168.el9_8.tuxcare.els2 0:3.2.33-168.el9_8.tuxcare.els2 aarch64|i686|x86_64 1:16.20.2-8.el9_8.tuxcare.els20 1:16.20.2-8.el9_8.tuxcare.els20 aarch64|i686|x86_64 1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20 aarch64|i686|x86_64 2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20 aarch64|i686|x86_64 0:1.6-19.el9_8.2.tuxcare.els2