Tuxcare Errata System 0.0.1 5.10 2026-08-31T16:20:14 Debian 10 * SECURITY UPDATE: path Equivalence leads to Remote Code Execution and/or Information disclosure - debian/patches/CVE-2025-24813.patch: Enhance lifecycle of temporary files used by partial PUT - CVE-2025-24813 Critical TuxCare License Agreement CVE-2025-24813 Debian 10 * SECURITY UPDATE: mod_rewrite proxy handler substitution and prefix_stat vulnerabilities - debian/patches/CVE-2024-38474-38475-*.patch: tighten up prefix_stat and %3f handling, add better question mark tracking to avoid UnsafeAllow3F - CVE-2024-38474, CVE-2024-38475 Critical TuxCare License Agreement CVE-2024-38476 CVE-2024-38474 CVE-2024-40725 CVE-2024-38475 CVE-2024-39884 Debian 10 * SECURITY UPDATE: excessive aggregate terms potentially leading to memory corruption - debian/patches/CVE-2025-6965.patch: fix a potential memory corruption if the number of aggregate terms in a query exceeds the maximum number of columns - CVE-2025-6965 Critical TuxCare License Agreement CVE-2025-6965 Debian 10 * SECURITY UPDATE: The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly - debian/patches/CVE-2023-44487.patch: HTTP/2 - per-iteration stream handling limit. - CVE-2023-44487 Important TuxCare License Agreement CVE-2023-44487 Debian 10 * SECURITY_UPDATE: avoid segfault on ${0::0/0~09J} - debian/patches/CVE-2022-48174.patch: Fix shell segfault in malformed arithmetic expressions - CVE-2022-48174 Critical TuxCare License Agreement CVE-2022-48174 Debian 10 * SECURITY UPDATE: Authentication bypass in external authentication plug-ins with only partially correct credentials - debian/patches/CVE-2022-0547.patch: disallow multiple deferred authentication plug-ins - CVE-2022-0547 * Update sample keys for testing - debian/sample-keys/* - debian/rules - debian/source/include-binaries Critical TuxCare License Agreement CVE-2022-0547 Debian 10 * SECURITY UPDATE: out-of-bound write - debian/patches/CVE-2024-11236: fix integer overflow causing in an out-of-bounds write ldap_escape() - CVE-2024-11236 * SECURITY UPDATE: incorrect URL truncation - debian/patches/CVE-2025-1861: fix possible incorrect URL truncation and redirecting to a wrong location - CVE-2025-1217 - CVE-2025-1734 - CVE-2025-1861 * SECURITY UPDATE: inadequate validation of user-supplied headers may lead to header misinterpretation - debian/patches/CVE-2025-1736.patch: Fix GHSA-hgf5-96fm-v528: Correct http user header CRLF check - CVE-2025-1736 Critical TuxCare License Agreement CVE-2024-11236 CVE-2025-1861 CVE-2025-1736 Debian 10 * SECURITY UPDATE: AD DC can be forced to issue rc4-hmac Kerberos tickets - debian/patches/CVE-2022-45141.patch: fix session key selection algorithm for selecting the ticket in strongest-to-weakest order, thus allowing the target server to select better encryption - CVE-2022-45141 Critical TuxCare License Agreement CVE-2022-45141 Debian 10 * SECURITY UPDATE: heap-based buffer overflow in function bfd_getl32 in objdump - debian/patches/CVE-2021-46174.patch: Don't read past end of section when concatentating stab strings in read_section_stabs_debugging_info() in rddbg.c - CVE-2021-46174 * SECURITY UPDATE: heap buffer overflow in find_section_in_set() in readelf - debian/patches/CVE-2022-44840.patch: Scan the pool directly - CVE-2022-44840 Important TuxCare License Agreement CVE-2022-44840 CVE-2021-46174 Debian 10 * SECURITY UPDATE: use-after-free vulnerability in XML schema processing - debian/patches/CVE-2024-56171.patch: Fix use-after-free after xmlSchemaItemListAdd in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables - CVE-2024-56171 Critical TuxCare License Agreement CVE-2024-56171 Debian 10 * SECURITY UPDATE: stack-based buffer overflow in disassemble_bytes function - debian/patches/CVE-2025-0840.patch: Fix stack-buffer-overflow by restricting size of insn_width buffer - CVE-2025-0840 Important TuxCare License Agreement CVE-2025-0840 Debian 10 * SECURITY UPDATE: missing TLS certificate verification - debian/patches/fixes/CVE-2023-31484.patch: enable SSL/TLS cert checking in .../CPAN/HTTP/Client.pm - CVE-2023-31484 Important TuxCare License Agreement CVE-2023-31484 Debian 10 * SECURITY UPDATE: privilege escalation via symlinks - debian/patches/CVE-2021-23240.patch: fix opportunity for local unprivileged user to gain file ownership via symlinks. * SECURITY UPDATE: unauthorized commands execution on unintended hosts - debian/patches/CVE-2025-32462.patch: restrict user from setting remote host for command unless listing privileges - CVE-2025-32462 * SECURITY UPDATE: row hammer attack - debian/patches/CVE-2023-42465.patch: make return values resist to single bit flips - CVE-2023-42465 Important TuxCare License Agreement CVE-2023-42465 CVE-2025-32462 CVE-2021-23240 Debian 10 * SECURITY UPDATE: privilege escalation vulnerability in privileged mode - debian/patches/CVE-2019-18276.patch: fix setuid/setgid handling when bash is running in privileged mode, use setresuid/setresgid over setuid/setgid when available - CVE-2019-18276 Important TuxCare License Agreement CVE-2019-18276 Debian 10 * SECURITY UPDATE: potential Denial of Service via TLS connection - debian/patches/CVE-2020-14058.patch: Fix sending of unknown validation errors to cert validator - CVE-2020-14058 * SECURITY UPDATE: improper Validation of Specified Index leads to Denial of Service via TLS Handshake vulnerability - debian/patches/CVE-2023-46724.patch: Fix validation of certificates with CN=* due to Buffer UnderRead in SSL CN Parsing issue (#1523) - CVE-2023-46724 * SECURITY UPDATE: denial of Service vulnerability in HTTP Chunked decoder due to uncontrolled recursion bug - debian/patches/CVE-2024-25111.patch: Fix infinite recursion when parsing HTTP chunks, prevent progress in call chain by stopping HttpStateData recursion - CVE-2024-25111 * SECURITY UPDATE: denial of Service vulnerability in the NTLM authentication credentials parser due to incorrect input validation - debian/patches/CVE-2020-8517.patch: Fix incorrect input validation allowing writing outside of buffer and leading to denial of service - CVE-2020-8517 * SECURITY UPDATE: denial of Service vulnerability against HTTP header parsing due to a Collapse of Data into Unsafe Value - debian/patches/CVE-2024-25617.patch: Improve handling of expanding HTTP header values to prevent DoS - CVE-2024-25617 * SECURITY UPDATE: denial of Service vulnerability by a trusted server - debian/rules: Disable ESI due to unfixed multiple issues in ESI causing DoS by a trusted server - debian/control: Remove dependencies used by ESI - CVE-2024-45802 Important TuxCare License Agreement CVE-2020-14058 CVE-2023-46724 CVE-2024-45802 CVE-2024-25111 CVE-2024-25617 CVE-2020-8517 Debian 10 * SECURITY UPDATE: Bypassing of some rewrite rules by a specially crafted request - debian/patches/CVE-2025-31651.patch: better handling of URLs - CVE-2025-31651 Critical TuxCare License Agreement CVE-2025-31651 CVE-2024-38286 Debian 10 * SECURITY UPDATE: Heap-based Buffer Overflow in visual mode - debian/patches/CVE-2022-3520.patch: check that the column does not become negative - CVE-2022-3520 Critical TuxCare License Agreement CVE-2022-1735 CVE-2021-3973 CVE-2022-1629 CVE-2022-3520 CVE-2022-1620 CVE-2021-3903 Debian 10 * SECURITY UPDATE: out-of-bounds access - debian/patches/CVE-2017-9118.patch: fix out of bounds access in php_pcre_replace_impl - CVE-2017-9118 * SECURITY UPDATE: improper validation of HTTP_REDIRECT_STATUS variable in CGI binary - debian/patches/CVE-2024-8927.patch: fix Apache server name check; remove references to redirect.so and Netscape; check configuration override first - CVE-2024-8927 * SECURITY UPDATE: buffer overread vulnerability - debian/patches/CVE-2024-11233.patch: move bound check upwards to fix single byte overread with convert.quoted-printable-decode filter - CVE-2024-11233 * SECURITY UPDATE: URI is not properly sanitized - debian/patches/CVE-2024-11234.patch: when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user - CVE-2024-11234 * SECURITY UPDATE: incomplete check in escaping functions - debian/patches/CVE-2025-1735.patch: pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid. - CVE-2025-1735 Important TuxCare License Agreement CVE-2017-9118 CVE-2024-11233 CVE-2025-1735 CVE-2024-11234 CVE-2024-8927 Debian 10 * SECURITY UPDATE: uninitialized-heap vulnerability in tic4x_print_cond function - debian/patches/CVE-2020-35342.patch: Initialize all elements of the condtable array to fix uninitialized heap memory issue in tic4x_print_cond function - CVE-2020-35342 Important TuxCare License Agreement CVE-2020-35342 CVE-2021-45078 Debian 10 * SECURITY UPDATE: insecure privilege dropping vulnerability - debian/patches/CVE-2019-20044-*.patch: improve error handling in setopt command, add OpenSSH-based setresuid/setresgid wrappers, simplify and secure privilege dropping logic, add comprehensive tests for PRIVILEGED option - CVE-2019-20044 Important TuxCare License Agreement CVE-2019-20044 Debian 10 * SECURITY UPDATE: NULL pointer dereference - debian/patches/CVE-2019-9923.patch: fix a NULL pointer dereference when parsing certain archives that have malformed extended headers in pax_decode_header() in sparse.c - CVE-2019-9923 Important TuxCare License Agreement CVE-2019-9923 Debian 10 * SECURITY UPDATE: Buffer Over-read because of invalid cursor position after "0;" range - debian/patches/CVE-2022-1927.patch: check the cursor position when it was set by ";" in the range - CVE-2022-1927 * SECURITY UPDATE: Use After Free in spell command - debian/patches/CVE-2022-2042.patch: initialize "attr", check for empty line early - CVE-2022-2042 * SECURITY UPDATE: Out-of-bounds Read when regex pattern starts with illegal byte - debian/patches/CVE-2022-2581.patch: do not match a character with an illegal byte - CVE-2022-2581 * SECURITY UPDATE: Heap-based Buffer Overflow with for loop over NULL string - debian/patches/CVE-2022-2849.patch: make sure mb_ptr2len() consistently returns zero for NUL - CVE-2022-2849 Important TuxCare License Agreement CVE-2022-2042 CVE-2022-1927 CVE-2022-2849 CVE-2022-2581 Debian 10 * SECURITY UPDATE: null pointer dereference in mod_proxy - debian/patches/CVE-2024-38477.patch: validate hostname in modules/proxy/proxy_util.c. Restart from the original URL on reconnect in modules/http2/mod_proxy_http2.c. - CVE-2024-38477 Important TuxCare License Agreement CVE-2024-38477 Debian 10 * SECURITY UPDATE: multiple vulnerabilities in AWK implementation - debian/patches/CVE-2021-423xx-awk.patch: fix issues with argument parsing, delete statement validation, length() parsing, post-increment/decrement on literals, expression handling, regex splitting, use-after-realloc, and maxfields underflow - CVE-2021-42378 - CVE-2021-42379 - CVE-2021-42380 - CVE-2021-42381 - CVE-2021-42382 - CVE-2021-42384 - CVE-2021-42385 - CVE-2021-42386 Important TuxCare License Agreement CVE-2021-42382 CVE-2021-42385 CVE-2021-42379 CVE-2021-42386 CVE-2021-42381 CVE-2021-42378 CVE-2021-42384 CVE-2021-42380 Debian 10 * SECURITY UPDATE: excessive cached HTTP response header size causing worker process stall or crash - debian/patches/CVE-2023-5824.patch: Refactor serialized HTTP response header handling to prevent cache flow - CVE-2023-5824 * SECURITY UPDATE: Use-After-Free in the HTTP Collapsed Forwarding Feature - debian/patches/CVE-2023-5824.patch: Removed Use-After-Free during refactor serialized HTTP response header - CVE-2023-49288 Important TuxCare License Agreement CVE-2023-49288 CVE-2023-5824 Debian 10 * SECURITY UPDATE: out-of-bounds stack write flaw in 64-bit architectures - debian/patches/CVE-2024-1013.patch: Fix incompatible pointer-to-integer types causing out-of-bounds stack writes on 64-bit architectures - CVE-2024-1013 Important TuxCare License Agreement CVE-2024-1013 Debian 10 * SECURITY UPDATE: Heap-based Buffer Overflow - debian/patches/CVE-2022-1733.patch: Check for NUL to prevent reading past end of the line when C-indenting - CVE-2022-1733 * SECURITY UPDATE: Use After Free - debian/patches/CVE-2022-1796.patch: Fix accessing freed memory when line is flushed by making a copy of the search pattern - CVE-2022-1796 * SECURITY UPDATE: Heap-based Buffer Overflow - debian/patches/CVE-2022-1886.patch: Check the length is more than zero to fix access before start of text with a put command - CVE-2022-1886 * SECURITY UPDATE: Use After Free - debian/patches/CVE-2022-3016.patch: Return QF_ABORT when location list changed in autocmd - CVE-2022-3016 Important TuxCare License Agreement CVE-2022-1886 CVE-2022-1796 CVE-2022-1733 CVE-2022-3016 Debian 10 * SECURITY UPDATE: multiple vulnerabilities in vms-alpha.c parse_module - debian/patches/CVE-2022-47673_CVE-2023-25584-*.patch: fix null pointer dereference in parse_module by adding return value checking for bfd_zalloc calls, fix potential out of bounds memory access in DST record parsing loop - CVE-2022-47673, CVE-2023-25584 Important TuxCare License Agreement CVE-2022-47673 CVE-2023-25584 Debian 10 * SECURITY UPDATE: denial of service via bfd_mach_o_get_synthetic_symtab in match-o.c - debian/patches/CVE-2022-47695.patch: Fix segmentation fault in compare_symbols function by excluding section and synthetic symbols before checking symbol flags - CVE-2022-47695 Important TuxCare License Agreement CVE-2022-47695 Debian 10 * SECURITY UPDATE: template injection allows code injection through specially crafted files - debian/patches/CVE-2023-5764.patch: avoid evaluate unsafe conditions - debian/patches/CVE-2023-5764-ext-tests.patch: addional tests - CVE-2023-5764 Important TuxCare License Agreement CVE-2023-5764 Debian 10 * SECURITY UPDATE: Improper restriction of XML External Entity Reference - debian/patches/CVE-2024-45490.patch: Reject negative len for XML_ParseBuffer - CVE-2024-45490 Important TuxCare License Agreement CVE-2024-45490 Debian 10 * SECURITY UPDATE: fix integer overflow in libbfd - debian/patches/CVE-2025-1000876.patch: Add overflow checks to prevent potential memory allocation issues from integer overflow - CVE-2025-1000876 Important TuxCare License Agreement CVE-2022-47696 CVE-2018-1000876 Debian 10 * SECURITY UPDATE: Reading past end of completion with a long line and 'infercase' set - debian/patches/CVE-2022-2343.patch: Allocate the string if needed - CVE-2022-2343 * SECURITY UPDATE: Accessing uninitialized memory when completing long line - debian/patches/CVE-2022-2522.patch: Terminate string with NUL. - CVE-2022-2522 Important TuxCare License Agreement CVE-2022-2125 CVE-2023-0049 CVE-2022-4292 CVE-2022-3591 CVE-2022-2264 CVE-2022-2845 CVE-2022-2344 CVE-2022-2206 CVE-2022-2257 CVE-2022-2210 CVE-2022-2182 CVE-2022-2522 CVE-2022-2207 CVE-2022-2175 CVE-2022-2183 CVE-2022-2343 CVE-2022-2345 CVE-2022-2289 CVE-2022-2126 CVE-2022-2124 CVE-2022-2287 CVE-2022-2286 CVE-2022-2284 Debian 10 * SECURITY UPDATE: missing SSL certificate validation vulnerability in wget - debian/patches/CVE-2018-1000500-1.patch: implement TLS verification with CENABLE_FEATURE_WGET_OPENSSL - debian/patches/CVE 2018-1000500-2.patch: fix openssl options for cert verification - CVE-2018-1000500 * SECURITY UPDATE: escape sequence injection attack - debian/patches/CVE-2022-28391-1.patch: sockaddr2str: ensure only printable characters are returned for the hostname part - debian/patches/CVE-2022-28391-2.patch: nslookup: sanitize all printed strings - CVE-2022-28391 * SECURITY UPDATE: directory traversal vulnerability in CPIO command - debian/patches/CVE-2023-39810.patch: archival: disallow path traversals - debian/config/pkg/*: regenerate to add the new FEATURE_PATH_TRAVERSAL_PROTECTION option - CVE-2023-39810 Important TuxCare License Agreement CVE-2018-1000500 CVE-2023-39810 CVE-2022-28391 Debian 10 * SECURITY UPDATE: integer overflow in PAC parsing - debian/patches/CVE-2022-42898.patch: catch overflows that result from adding PAC_INFO_BUFFER_SIZE - CVE-2022-42898 Important TuxCare License Agreement CVE-2022-42898 Debian 10 * SECURITY UPDATE: Stack-based Buffer Overflow with unexpected :finally - debian/patches/CVE-2022-3296.patch: check CSF_TRY can be found - CVE-2022-3296 * Fix Test_terminal_noblock() - debian/patches/fix-flaky-terminal-noblock-test.patch Important TuxCare License Agreement CVE-2024-22667 CVE-2023-5344 CVE-2023-4750 CVE-2023-0433 CVE-2022-3296 CVE-2023-5535 CVE-2023-0288 CVE-2023-4735 CVE-2023-4733 CVE-2023-4751 Debian 10 * SECURITY UPDATE: Overwrite a local file - debian/patches/CVE-2023-30630.patch: Prevent --dump-bin from overwriting local files to address privilege escalation vulnerability - CVE-2023-30630 Important TuxCare License Agreement CVE-2023-30630 Debian 10 * SECURITY UPDATE: The DNS message parsing code in `named` includes a section whose computational complexity is overly high - debian/patches/CVE-2023-4408.patch: refactoring parsing code - debian/patches/CVE-2023-4408-1.patch: fix DNSSEC test suite - debian/libdns1100.symbols: some function declarations were removed according to the CVE-2023-4408.patch - CVE-2023-4408 * Add patch for enabling automated testing Important TuxCare License Agreement CVE-2023-4408 Debian 10 * SECURITY UPDATE: DNS string buffer overflow - debian/patches/CVE-2020-10745.patch: add input validation to prevent buffer overflows when handling DNS/NBT names with consecutive dots or exceeding RFC 1035 255-byte limit. The fix enforces proper bounds checking and component length validation in ndr_push_dns_string() and ndr_push_nbt_string() functions. - CVE-2020-10745 * SECURITY UPDATE: panic in krb5_pac_parse() - debian/patches/0001-Additional-fix-for-CVE-2022-42898.patch: check pointer for NULL - CVE-2022-42898 Important TuxCare License Agreement CVE-2020-10745 Debian 10 * SECURITY UPDATE: mishandling of semicolons in userinfo - debian/patches/CVE-2024-38428.patch: properly re-implement userinfo parsing in src/url.c. - CVE-2024-38428 Critical TuxCare License Agreement CVE-2024-38428 Debian 10 * SECURITY UPDATE: Unsafe chown/chmod operations in .service files - debian/patches/CVE-2021-44038.patch: remove chown/chmod commands from the .service files - CVE-2021-44038 Important TuxCare License Agreement CVE-2021-44038 Debian 10 * SECURITY UPDATE: Integer Overflow in g_option_group_add_entries - debian/patches/CVE-2020-35457.patch: goption: add a precondition to avoid GOptionEntry list overflow - CVE-2020-35457 Important TuxCare License Agreement CVE-2020-35457 Debian 10 * SECURITY UPDATE: malicious remote servers to write arbitrary files inside the directories of connecting peers: - debian/patches/els/0001-CVE-2022-29154.patch: fix insufficient validation of file names. - CVE-2022-29154. * SECURITY UPDATE: path traversal vulnerability. - debian/patches/els/0002-CVE-2024-12087.patch: refuse a duplicate dirlist and range check dir_ndx before use - CVE-2024-12087 * SECURITY UPDATE: rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it: - debian/patches/els/0003-CVE-2024-12088.patch: make --safe-links stricter. - CVE-2024-12088. Important TuxCare License Agreement CVE-2022-29154 CVE-2024-12088 CVE-2024-12087 Debian 10 * SECURITY UPDATE: Privilege chaining vulnerability - debian/patches/CVE-2019-3843.patch: introduce functionality for blocking chmod() for suid/sgid files with new unit setting RestrictSUIDSGID= - CVE-2019-3843 * SECURITY UPDATE: Privilege chaining vulnerability - debian/patches/CVE-2019-3844.patch: imply NNP and SUID/SGID restriction for DynamicUser=yes service - CVE-2019-3844 Important TuxCare License Agreement CVE-2019-3844 CVE-2019-3843 Debian 10 * SECURITY UPDATE: failure to redact HTTP authentication credentials in error handling allows information disclosure - debian/patches/CVE-2025-62168.patch: Fix HttpRequest::pack to mask sensitive information to prevent disclosure - CVE-2025-62168 Important TuxCare License Agreement CVE-2025-62168 Debian 10 * SECURITY UPDATE: stack memory exhaustion vulnerability - debian/patches/CVE-2020-10704.patch: fix vulnerability where a deeply nested filter in an unauthenticated LDAP search can exhaust the LDAP server's attack memory causing a SIGSEGV - CVE-2020-10704 Important TuxCare License Agreement CVE-2020-10704 Debian 10 * SECURITY UPDATE: Directory permission cleanup vulnerability leading to DoS - debian/patches/CVE-2025-6297.patch: Fix cleanup for control member with restricted directories - CVE-2025-6297 Low TuxCare License Agreement CVE-2025-6297 Debian 10 * SECURITY UPDATE: Buffer overflow when ELF section size is invalid - debian/patches/CVE-2019-1010180.patch: Skip processing invalid ELF sections - CVE-2019-1010180 Important TuxCare License Agreement CVE-2019-1010180 Debian 10 * SECURITY UPDATE: improper neutralization of quoting syntax in libpq functions allows SQL injection via psql in certain usage patterns - debian/patches/CVE-2025-1094.patch: Fix handling of invalidly encoded data in escaping functions - CVE-2025-1094 Important TuxCare License Agreement CVE-2025-1094 Debian 10 * SECURITY UPDATE: use after free in Samba AD DC RPC server - debian/patches/CVE-2021-3738-pre.patch: prepare service routines before fixing CVE-2021-3738 - debian/patches/CVE-2021-3738.patch: avoids a crash caused by use-after-free in Samba AD DC RPC server - CVE-2021-3738.patch Important TuxCare License Agreement CVE-2021-3738 Debian 10 * SECURITY UPDATE: Heap-buffer overflow when switching buffers in visual mode - debian/patches/CVE-2025-22134.patch: fix visual mode heap-buffer-overflow by resetting VIsual mode on :all - CVE-2025-22134 Moderate TuxCare License Agreement CVE-2025-22134 Debian 10 * SECURITY UPDATE: VerifyHostKeyDNS server impersonation - debian/patches/CVE-2025-26465.patch: Fix cases where error codes were not correctly set - CVE-2025-26465 Moderate TuxCare License Agreement CVE-2025-26465 Debian 10 * SECURITY UPDATE: elevation of privilege vulnerability - debian/patches/CVE-2020-1472.patch: fix vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC) - CVE-2020-1472 Low TuxCare License Agreement CVE-2020-1472 Debian 10 * SECURITY UPDATE: DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. - debian/patches/CVE-2025-32728.patch: fix logic error in DisableForwarding option - CVE-2025-32728 Low TuxCare License Agreement CVE-2025-32728 Debian 10 * SECURITY UPDATE: Carriage Return injection in credential protocol - debian/patches/CVE-2024-52006.patch: fix Carriage Return injection in credential protocol - CVE-2024-52006 Important TuxCare License Agreement CVE-2024-52006 Debian 10 * SECURITY UPDATE: heap buffer overflow in array_merge() - debian/patches/CVE-2025-14178.patch: fix integer overflow in the precomputation of element counts using zend_hash_num_elements() - CVE-2025-14178 Important TuxCare License Agreement CVE-2025-14178 Debian 10 * SECURITY UPDATE: fix DoS by a client that connect to cupsd sends slow messages. - debian/patches/CVE-2025-58436.patch: fix unresponsive cupsd process caused by a slow client. - CVE-2025-58436. * Fix test/run-stp-tests.sh - debian/patches/waiting-limit.patch: limit the waiting for a server dunring tests Moderate TuxCare License Agreement CVE-2025-58436 Debian 10 * SECURITY UPDATE: improper encoding or escaping of credential handling - debian/patches/CVE-2024-50349.patch: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively - CVE-2024-50349 Moderate TuxCare License Agreement CVE-2024-50349 Debian 10 * SECURITY UPDATE: Ownership checks for local repositories - debian/patches/CVE-2024-32004.patch: add fix for ownership check in local repositories - CVE-2024-32004 Important TuxCare License Agreement CVE-2024-32004 Debian 10 * SECURITY UPDATE: memory corruption in armor parser - debian/patches/CVE-2025-68973.patch: fix faulty double increment. - CVE-2025-68973 Important TuxCare License Agreement CVE-2025-68973 Debian 10 * SECURITY UPDATE: Make XML_ExternalEntityParserCreate copy unknown encoding handler user data - debian/patches/CVE-2026-24515.patch: copy unknown encoding handler user data and add tests to cover effect - CVE-2026-24515 Low TuxCare License Agreement CVE-2026-24515 Debian 10 * SECURITY UPDATE: check oct argument for NULL in PKCS12_item_decrypt_d2i_e() - debian/patches/CVE-2025-69421.patch: fix a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. - CVE-2025-69421 Important TuxCare License Agreement CVE-2025-69421 Debian 10 * SECURITY UPDATE: check return code of UTF8_putc - debian/patches/CVE-2025-69419.patch: add missing return code checks for UTF8_putc in a_strex.c and OPENSSL_uni2utf8 in p12_utl.c. - CVE-2025-69419 Important TuxCare License Agreement CVE-2025-69419 Debian 10 * SECURITY UPDATE: Buffer underflow / integer overflow in GVariant text format parser - debian/patches/CVE-2025-14087.patch: fix potential integer overflow parsing strings, bytestrings, and child element counts in gvariant-parser.c - CVE-2025-14087 Critical TuxCare License Agreement CVE-2025-14087 Debian 10 * SECURITY UPDATE: bearer token leakage to IMAP/LDAP/POP3/SMTP hosts via cross-protocol redirects - debian/patches/CVE-2025-14524.patch: Require permission when redirected for bearer use and prevent sending bearer token to other hosts; fix unconditional reuse of oauth bearer during redirects. - CVE-2025-14524 Low TuxCare License Agreement CVE-2025-14524 Debian 10 * SECURITY UPDATE: Stack-Based buffer overflow in Netbeans - debian/patches/CVE-2026-26269.patch: fix stack-based buffer overflow in NetBeans integration that could lead to a crash or arbitrary code execution via a malicious server - CVE-2026-26269 Important TuxCare License Agreement CVE-2026-26269 Debian 10 * SECURITY UPDATE: Fix vulnerabilities in GSS message token handling - debian/patches/CVE-2024-37370-CVE-2024-37371.patch: Verify Extra Count field in CFX wrap tokens, validate plaintext length in gss_unwrap, and prevent IOV unwrap header buffer overrun - CVE-2024-37370 - CVE-2024-37371 Critical TuxCare License Agreement CVE-2024-37370 CVE-2024-37371 Debian 10 * SECURITY UPDATE: acceptance of hosts not listed in specified known_hosts file during SSH-based transfers - debian/patches/CVE-2025-15079.patch: Set both knownhosts options to same file and fix surprises caused by libssh exposing separate KNOWNHOSTS and GLOBAL_KNOWNHOSTS options. - CVE-2025-15079 * Regenerate Server-localhost-lastSAN-sv test certificate with SHA-256 - debian/patches/regenerate-lastSAN-cert-sha256.patch: Fix "ca md too weak" error with OpenSSL 1.1.1+ by replacing SHA-1 signed certificate with SHA-256. Also fixes Makefile.am bug for lastSAN target. * Update failed test - debian/patches/26_CVE-2021-22876.patch: Update test to avoid using unsupported commands * Update failed test - debian/patches/fix-test323-errorcode.patch: two valid error codes now * Disable some tests - debian/rules: add option to disable tests marked as flaky, fail the build if any test fails - debian/patches/add-flaky-to-test1592.patch: mark test1592 as flaky - debian/patches/disable-nss-failing-tests.patch: libnsspem.so is not available on Debian 10 * Remove unsupported test: - debian/patches/test8-verify-that-ctrl-byte-cookies-are-ignored.patch: no ctrl-byte-cookies are supported Low TuxCare License Agreement CVE-2025-15079 Debian 10 * SECURITY UPDATE: reuse of connections using HTTP Negotiate - debian/patches/CVE-2026-1965.patch: fix reuse of connections using HTTP Negotiate and fix copy and paste url_match_auth_nego mistake. - CVE-2026-1965 * Bearer token sent without checking auth is allowed - debian/patches/CVE-2026-3783.patch: only send bearer if auth is allowed. - CVE-2026-3783 * Proxy credential reuse across different credentials - debian/patches/CVE-2026-3784.patch: compare proxy credentials in proxy_info_matches to prevent connection reuse with wrong auth. - CVE-2026-3784 Moderate TuxCare License Agreement CVE-2026-1965 CVE-2026-3783 CVE-2026-3784 Debian 10 * SECURITY UPDATE: Improve determination of buffer size bufSize in function doContent - debian/patches/CVE-2026-25210.patch: fix integer overflow in doContent tag buffer reallocation - CVE-2026-25210 Important TuxCare License Agreement CVE-2026-25210 Debian 10 * SECURITY UPDATE: SNI hostname not stored for NIO2 and APR connectors - debian/patches/CVE-2025-66614.patch: store SNI hostname for NIO2 and APR connections so that SNI checks are not bypassed - CVE-2025-66614 Critical TuxCare License Agreement CVE-2025-66614 Debian 10 * SECURITY UPDATE: Crash when recovering a corrupted swap file - debian/patches/CVE-2026-28421.patch: add bounds checks in swap file recovery to prevent heap-buffer-overflow and SEGV from crafted swap files - CVE-2026-28421 * SECURITY UPDATE: Command injection via crafted netrw URIs - debian/patches/CVE-2026-28417.patch: fix command injection in netrw via crafted scp:// URIs by adding strict hostname validation and shellescape() - CVE-2026-28417 Important TuxCare License Agreement CVE-2026-28417 CVE-2026-28421 Debian 10 * SECURITY UPDATE: Denial of Service in ICP request handling via double rfc1738_escape() call causing heap use-after-free - debian/patches/CVE-2026-33526.patch: Remove redundant rfc1738_escape() call in icpGetRequest() - CVE-2026-33526 * SECURITY UPDATE: Denial of Service in ICP v3 query handling via use-after-free of HttpRequest object - debian/patches/CVE-2026-32748.patch: Add proper HTTPMSGLOCK/HTTPMSGUNLOCK to doV3Query() to match doV2Query() locking pattern - CVE-2026-32748 * SECURITY UPDATE: Out-of-bounds read in ICP message handling allows information disclosure - debian/patches/CVE-2026-33515.patch: Add icpGetUrl() validation function to check packet bounds and NUL-termination of URLs in ICP messages - CVE-2026-33515 Important TuxCare License Agreement CVE-2026-33526 CVE-2026-32748 CVE-2026-33515 Debian 10 * SECURITY UPDATE: signature verification DoS via malicious subkey - debian/patches/CVE-2025-30258.patch: require signing usage when looking up public key for signature verification, filtering out subkeys without valid backsig. Include upstream regression fixes to preserve verification of signatures from expired/revoked keys. Widen pubkey_usage and req_usage fields from byte to u16 to prevent PUBKEY_USAGE_VERIFY (16384) from being truncated on GnuPG 2.2.x. Add primary-key-only lookup during import to prevent malicious subkey attack at import time. Fix double-free in check_signature_over_key_or_uid when signer is caller-owned. - CVE-2025-30258 Moderate TuxCare License Agreement CVE-2025-30258 Debian 10 * SECURITY UPDATE: fix heap-based buffer overflow in _bfd_elf_parse_eh_frame - debian/patches/CVE-2025-11082.patch: add bounds check before reading buf[1] in the legacy "eh" CIE path - CVE-2025-11082 Important TuxCare License Agreement CVE-2025-11082 Debian 10 * SECURITY UPDATE: fix vulnerability in stream handling - debian/patches/CVE-2025-53019.patch: fix vulnerability in stream handling - CVE-2025-53019 * SECURITY UPDATE: fix integer overflow in resize - debian/patches/CVE-2025-55212.patch: fix integer overflow in resize - CVE-2025-55212 * SECURITY UPDATE: fix heap-based buffer overflow in image processing - debian/patches/CVE-2025-55298.patch: fix heap-based buffer overflow in image processing - CVE-2025-55298 * SECURITY UPDATE: fix buffer overflow in BMP coder - debian/patches/CVE-2025-57803.patch: fix buffer overflow in BMP coder - CVE-2025-57803 * SECURITY UPDATE: fix vulnerability in PNG coder - debian/patches/CVE-2025-55154.patch: fix vulnerability in PNG coder - CVE-2025-55154 * SECURITY UPDATE: fix buffer overflow in BMP coder on 32-bit systems - debian/patches/CVE-2025-62171.patch: fix buffer overflow in BMP coder on 32-bit systems - CVE-2025-62171 * SECURITY UPDATE: fix stack overflow via infinite recursion in MSL and SVG coders - debian/patches/CVE-2025-68618.patch: fix stack overflow via infinite recursion in MSL and SVG coders - CVE-2025-68618 * SECURITY UPDATE: fix denial of service in SVG coder - debian/patches/CVE-2025-69204.patch: fix denial of service in SVG coder - CVE-2025-69204 Important TuxCare License Agreement CVE-2025-62171 CVE-2025-55212 CVE-2025-57803 CVE-2025-69204 CVE-2025-55298 CVE-2025-55154 CVE-2025-68618 CVE-2025-53019 Debian 10 * SECURITY UPDATE: fix division by zero in YUV coder - debian/patches/CVE-2026-25799.patch: fix division by zero in YUV coder - CVE-2026-25799 * SECURITY UPDATE: fix NULL pointer dereference in SFW coder - debian/patches/CVE-2026-25795.patch: fix NULL pointer dereference in SFW coder - CVE-2026-25795 * SECURITY UPDATE: fix infinite loop in META coder - debian/patches/CVE-2026-26066.patch: fix infinite loop in META coder - CVE-2026-26066 * SECURITY UPDATE: fix vulnerability in JPEG coder - debian/patches/CVE-2026-26283.patch: fix vulnerability in JPEG coder - CVE-2026-26283 * SECURITY UPDATE: fix NULL pointer dereference in cache handling - debian/patches/CVE-2026-25798.patch: fix NULL pointer dereference in cache handling - CVE-2026-25798 * SECURITY UPDATE: fix vulnerability in PSD coder - debian/patches/CVE-2026-24481.patch: fix vulnerability in PSD coder - CVE-2026-24481 * SECURITY UPDATE: fix vulnerability in stegano coder - debian/patches/CVE-2026-25796.patch: fix vulnerability in stegano coder - CVE-2026-25796 * SECURITY UPDATE: fix vulnerability in FX processing - debian/patches/CVE-2026-27798.patch: fix vulnerability in FX processing - CVE-2026-27798 Important TuxCare License Agreement CVE-2026-25795 CVE-2026-24481 CVE-2026-25799 CVE-2026-25796 CVE-2026-27798 CVE-2026-26283 CVE-2026-25798 CVE-2026-26066 Debian 10 * SECURITY UPDATE: fix vulnerability in MSL coder - debian/patches/CVE-2026-25988.patch: fix vulnerability in MSL coder - CVE-2026-25988 * SECURITY UPDATE: fix path traversal via policy bypass - debian/patches/CVE-2026-25965.patch: fix path traversal via policy bypass - CVE-2026-25965 * SECURITY UPDATE: fix vulnerability in PNG coder - debian/patches/CVE-2026-30883.patch: fix vulnerability in PNG coder - CVE-2026-30883 * SECURITY UPDATE: fix NULL pointer dereference in MSL parser - debian/patches/CVE-2026-23952.patch: fix NULL pointer dereference in MSL parser - CVE-2026-23952 * SECURITY UPDATE: fix vulnerability in sixel coder - debian/patches/CVE-2026-25970.patch: fix vulnerability in sixel coder - CVE-2026-25970 Important TuxCare License Agreement CVE-2026-25988 CVE-2026-25965 Debian 10 * SECURITY UPDATE: fix vulnerability in image handling - debian/patches/CVE-2025-53101.patch: fix vulnerability in image handling - CVE-2025-53101 * SECURITY UPDATE: fix vulnerability in image handling - debian/patches/CVE-2025-53014.patch: fix vulnerability in image handling - CVE-2025-53014 * SECURITY UPDATE: fix heap-based buffer overflow in blob handling - debian/patches/CVE-2025-57807.patch: fix heap-based buffer overflow in blob handling - CVE-2025-57807 * SECURITY UPDATE: fix heap-based buffer overflow in XBM coder - debian/patches/CVE-2026-23876.patch: fix heap-based buffer overflow in XBM coder - CVE-2026-23876 * SECURITY UPDATE: fix buffer overflow in SUN coder - debian/patches/CVE-2026-25897.patch: fix buffer overflow in SUN coder - CVE-2026-25897 * SECURITY UPDATE: fix buffer overflow in PCD coder - debian/patches/CVE-2026-26284.patch: fix buffer overflow in PCD coder - CVE-2026-26284 * SECURITY UPDATE: fix vulnerability in MSL coder - debian/patches/CVE-2026-25968.patch: fix vulnerability in MSL coder - CVE-2026-25968 * SECURITY UPDATE: fix buffer overflow in YUV coder - debian/patches/CVE-2026-25986.patch: fix buffer overflow in YUV coder - CVE-2026-25986 * SECURITY UPDATE: fix buffer overflow in MAP coder - debian/patches/CVE-2026-25987.patch: fix buffer overflow in MAP coder - CVE-2026-25987 * SECURITY UPDATE: fix buffer overflow in UIL and XPM coders - debian/patches/CVE-2026-25898.patch: fix buffer overflow in UIL and XPM coders - CVE-2026-25898 * SECURITY UPDATE: fix heap-use-after-free in MSL coder - debian/patches/CVE-2026-25983.patch: fix heap-use-after-free in MSL coder - CVE-2026-25983 * SECURITY UPDATE: fix stack overflow via infinite recursion in MSL, SVG, and draw handling - debian/patches/CVE-2026-25971.patch: fix stack overflow via infinite recursion in MSL, SVG, and draw handling - CVE-2026-25971 Critical TuxCare License Agreement CVE-2025-57807 CVE-2026-25986 CVE-2026-25968 CVE-2026-25897 CVE-2026-25987 CVE-2026-25971 CVE-2025-53101 CVE-2026-25967 CVE-2026-26284 CVE-2025-53014 CVE-2026-23876 CVE-2026-25983 CVE-2026-22770 CVE-2026-25898 Debian 10 * SECURITY UPDATE: filter control characters from option values in the scheduler to prevent PPD keyword injection via Print-Job. - debian/patches/CVE-2026-34980.patch: filter out control characters from IPP option values in scheduler/job.c and filter out special PPD keywords in the CUPSD_LOG_PPD branch of update_job(). - CVE-2026-34980. Important TuxCare License Agreement CVE-2026-34980 Debian 10 * SECURITY UPDATE: Command injection via newline in glob() on Unix-like systems - debian/patches/CVE-2026-33412.patch: add '\n' to the SHELL_SPECIAL macro in src/os_unix.c so mch_expand_wildcards() escapes embedded newlines before passing the glob pattern to the shell - CVE-2026-33412 Important TuxCare License Agreement CVE-2026-33412 Debian 10 * SECURITY UPDATE: fix out-of-bounds write in ConvertUTF16ToUTF8 in NewXMLTree - debian/patches/CVE-2026-32636.patch: fix out-of-bounds write in ConvertUTF16ToUTF8 in NewXMLTree - CVE-2026-32636 Important TuxCare License Agreement CVE-2026-32636 Debian 10 * SECURITY UPDATE: stack-based buffer overflow in infocmp - debian/patches/CVE-2025-69720.patch: add a bounds check on strlen(cp) in analyze_string() in progs/infocmp.c and grow buf2 by one byte so a maliciously long SGR parameter list can no longer overflow the stack buffer. - CVE-2025-69720 Important TuxCare License Agreement CVE-2025-69720 Debian 10 * SECURITY UPDATE: heap-based buffer overflow in copy_section function - debian/patches/CVE-2025-7545.patch: Prevent output section size from being extended beyond the input section size to avoid heap-based buffer overflow when copying sections with interleaving - CVE-2025-7545 Important TuxCare License Agreement CVE-2025-7545 CVE-2025-5244 CVE-2025-5245 Debian 10 * SECURITY UPDATE: fix heap-based buffer overflow in VIFF coder - debian/patches/CVE-2026-33900.patch: fix heap-based buffer overflow in VIFF coder - CVE-2026-33900 * SECURITY UPDATE: fix heap-based buffer overflow in SampleImage - debian/patches/CVE-2026-33905.patch: fix heap-based buffer overflow in SampleImage - CVE-2026-33905 * SECURITY UPDATE: fix integer overflow in DespeckleImage - debian/patches/CVE-2026-34238.patch: fix integer overflow in DespeckleImage - CVE-2026-34238 * SECURITY UPDATE: fix heap out-of-bounds write in JP2 coder - debian/patches/CVE-2026-40310.patch: fix heap out-of-bounds write in JP2 coder - CVE-2026-40310 * SECURITY UPDATE: fix vulnerability in GetXMPProperty - debian/patches/CVE-2026-40311.patch: fix vulnerability in GetXMPProperty - CVE-2026-40311 Important TuxCare License Agreement CVE-2026-40310 CVE-2026-33900 CVE-2026-33905 CVE-2026-34238 CVE-2026-40311 Debian 10 * SECURITY UPDATE: fix quadratic complexity in http cookie parsing with backslash escapes - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in http cookie parsing with backslash escapes - CVE-2024-7592 * SECURITY UPDATE: reject leading dashes in webbrowser URLs and %action substitution bypass - debian/patches/CVE-2026-4519.patch: reject leading dashes in webbrowser URLs and %action substitution bypass - CVE-2026-4519 * SECURITY UPDATE: fix quadratic complexity in os.path.expandvars() - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in os.path.expandvars() - CVE-2025-6075 * SECURITY UPDATE: remove quadratic behavior in xml.dom.minidom node id-cache clearing - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in xml.dom.minidom node id-cache clearing - CVE-2025-12084 * SECURITY UPDATE: remove backtracking when parsing tarfile PAX headers - debian/patches/CVE-2024-6232.patch: remove backtracking when parsing tarfile PAX headers - CVE-2024-6232 * SECURITY UPDATE: reject malformed addresses in email.utils.parseaddr / getaddresses - debian/patches/CVE-2023-27043.patch: reject malformed addresses in email.utils.parseaddr / getaddresses - CVE-2023-27043 Important TuxCare License Agreement CVE-2023-27043 CVE-2024-6232 CVE-2025-12084 CVE-2026-4519 CVE-2024-7592 CVE-2025-6075 Debian 10 * SECURITY UPDATE: scp(1) downloading as root in legacy mode without -p did not clear setuid/setgid bits on downloaded files. - debian/patches/CVE-2026-35385.patch: clear setuid/setgid bits from umask in sink() when -p is not set - CVE-2026-35385 Important TuxCare License Agreement CVE-2026-35385 Debian 10 * SECURITY UPDATE: fix command injection in netbeans interface via defineAnnoType (validate typeName/fg/bg/specialKeys) - debian/patches/CVE-2026-39881.patch: fix command injection in netbeans interface via defineAnnoType (validate typeName/fg/bg/specialKeys) - CVE-2026-39881 Important TuxCare License Agreement CVE-2026-39881 Debian 10 * SECURITY UPDATE: authorized_keys principals="" option mismatches certificate principals containing comma characters. - debian/patches/CVE-2026-35414.patch: rewrite match_principals_option to split principal_list with strsep() and compare with strcmp(). - CVE-2026-35414 Important TuxCare License Agreement CVE-2026-35414 Debian 10 * SECURITY UPDATE: HTTP/2 memory leak in nghttp2 codec - debian/patches/CVE-2023-35945.patch: fix memory leak in nghttp2_session_mem_send_internal when stream close callback fails with a fatal error - CVE-2023-35945 Important TuxCare License Agreement CVE-2023-35945 Debian 10 * SECURITY UPDATE: Integer overflow in Lua cmsgpack library - debian/patches/CVE-2022-24834.patch: partial backport hardening deps/lua/src/lua_cmsgpack.c against integer overflows in mp_buf_append and the encode/decode helpers (cmsgpack-only; the cjson half of the upstream fix is dead code under USE_SYSTEM_LUA=yes and is tracked via the lua-cjson source package) - CVE-2022-24834 Important TuxCare License Agreement CVE-2025-32023 CVE-2022-24834 Debian 10 * SECURITY UPDATE: fix UAF/double-free in DANE client by using X509_free() for dane->mcert - debian/patches/CVE-2026-28387.patch: fix UAF/double-free in DANE client by using X509_free() for dane->mcert - CVE-2026-28387 * SECURITY UPDATE: NULL check delta->crl_number before ASN1_INTEGER_cmp() in check_delta_base() - debian/patches/CVE-2026-28388.patch: NULL check delta->crl_number before ASN1_INTEGER_cmp() in check_delta_base() - CVE-2026-28388 * SECURITY UPDATE: NULL check alg->parameter in [ec]dh_cms_set_shared_info() before deref - debian/patches/CVE-2026-28389.patch: NULL check alg->parameter in [ec]dh_cms_set_shared_info() before deref - CVE-2026-28389 * SECURITY UPDATE: NULL check plab->parameter in rsa_cms_decrypt() before deref - debian/patches/CVE-2026-28390.patch: NULL check plab->parameter in rsa_cms_decrypt() before deref - CVE-2026-28390 Important TuxCare License Agreement CVE-2026-28389 CVE-2026-28390 CVE-2026-28388 CVE-2026-28387 Debian 10 * SECURITY UPDATE: double free / possible RCE in mod_http2 stream purge - debian/patches/CVE-2026-23918.patch: deduplicate inserts into the spurge array in modules/http2/h2_mplx.c via a new add_for_purge() helper to prevent the same h2_stream from being freed twice. - CVE-2026-23918 Important TuxCare License Agreement CVE-2026-23918 Debian 10 * SECURITY UPDATE: fix authorization bypass in cupsd caused by case-insensitive comparison of local user and group names. - debian/patches/CVE-2026-27447.patch: compare usernames against the canonical pw_name from getpwnam() with strcmp() in cupsdCheckGroup() and cupsdIsAuthorized() in scheduler/auth.c; include the upstream follow-up "Fix unauthenticated print policies" (Issue #1557) so CUPSD_AUTH_NONE policies still match users that do not have a local account. - CVE-2026-27447. Moderate TuxCare License Agreement CVE-2026-27447 Debian 10 * SECURITY UPDATE: heap-based OOB read in xcoff_link_add_symbols (bfd/xcofflink.c) triggered by a crafted XCOFF object file - debian/patches/binutils-CVE-2026-3441-3442.patch: bounds-check XTY_LD x_scnlen csect index and sanity-check r_symndx before indexing sym_hashes - CVE-2026-3441 - CVE-2026-3442 Important TuxCare License Agreement CVE-2026-3442 CVE-2026-3441 Debian 10 * SECURITY UPDATE: Heap buffer overflow in ngx_http_rewrite_module via PCRE unnamed captures with question mark in replacement strings - debian/patches/CVE-2026-42945.patch: clear e->is_args in ngx_http_script_regex_end_code to prevent buffer overrun when rewrite directive is followed by set or if with PCRE captures - CVE-2026-42945 Important TuxCare License Agreement CVE-2026-42945 Debian 10 * SECURITY UPDATE: Crash in XML_ResumeParser because XML_StopParser can stop/suspend an unstarted parser - debian/patches/CVE-2024-50602.patch: make XML_StopParser refuse to stop/suspend an unstarted parser - CVE-2024-50602 Moderate TuxCare License Agreement CVE-2024-50602 Debian 10 * SECURITY UPDATE: Fix integer overflow in userauth_password username_len/password_len bounds checks - debian/patches/CVE-2026-7598.patch: Fix integer overflow in userauth_password username_len/password_len bounds checks - CVE-2026-7598 Critical TuxCare License Agreement CVE-2026-7598 Debian 10 * SECURITY UPDATE: Fix buffer over-read in DSN code parsing (dsn_split) - debian/patches/CVE-2026-43964.patch: Fix buffer over-read in DSN code parsing (dsn_split) - CVE-2026-43964 Important TuxCare License Agreement CVE-2026-43964 Debian 10 * SECURITY UPDATE: SOAP use-after-free with SOAP_PERSISTENCE_SESSION - debian/patches/CVE-2026-7261.patch: skip zval_ptr_dtor on the persisted soap_obj after header parsing failure when persistence is SOAP_PERSISTENCE_SESSION - CVE-2026-7261 * SECURITY UPDATE: SOAP use-after-free via Apache Map with duplicate keys - debian/patches/CVE-2026-6722.patch: do not store stale pointers in SOAP_GLOBAL(ref_map) when the encoded zval is freed during Apache Map decoding with duplicate keys - CVE-2026-6722 * SECURITY UPDATE: signed integer overflow of char array offset in metaphone() - debian/patches/CVE-2026-7568.patch: switch metaphone position tracker to size_t and bound character-offset arithmetic to prevent signed overflow on inputs larger than INT_MAX bytes - CVE-2026-7568 * SECURITY UPDATE: SOAP NULL pointer dereference in Apache Map decoding - debian/patches/CVE-2026-7262.patch: check the value element before dereferencing it when decoding Apache Map entries - CVE-2026-7262 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 10 * SECURITY UPDATE: ReDoS in tarfile PAX header parsing - debian/patches/CVE-2024-6232.patch: rewrite Lib/tarfile.py PAX-record parser to scan length-prefixed records via a bounded regex (_header_length_prefix_re) plus direct slicing, eliminating quadratic backtracking in three pre-existing regexes. Adapted from upstream commit 7d1f50cd (3.8 backport); walrus operator rewritten as assign-then-test for Python 3.7. - CVE-2024-6232 * SECURITY UPDATE: quadratic complexity in http.cookies._unquote - debian/patches/CVE-2024-7592.patch: replace the O(n^2) _OctalPatt/_QuotePatt while-loop in Lib/http/cookies.py with a single linear re.sub() driven by an alternation pattern and _unquote_replace callback. Verbatim from upstream commit 44e45835 / 3.8 backport a77ab244. - CVE-2024-7592 * SECURITY UPDATE: shell injection via venv activation script substitutions - debian/patches/CVE-2024-9287.patch: shell-quote __VENV_*__ placeholder substitutions in Lib/venv/__init__.py via shlex.quote (sh/csh/fish) and remove surrounding double-quotes from activate/activate.csh/activate.fish templates so the now-pre-quoted values splice safely. Adapted from upstream 3.9 backport 633555735a; Lib/venv/scripts/nt/Activate.ps1 deliberately untouched (matches upstream 3.9-3.12 backport scope). - CVE-2024-9287 Important TuxCare License Agreement CVE-2023-24329 CVE-2021-28861 CVE-2024-6232 CVE-2024-7592 CVE-2024-9287 CVE-2022-0391 Debian 10 * SECURITY UPDATE: memory denial of service via attacker-controlled Content-Length in http.client - debian/patches/CVE-2025-13836.patch: rewrite Lib/http/client.py _safe_read to read large responses in geometrically-growing chunks bounded by _MIN_READ_BUF_SIZE (1 MiB), preventing OOM when a malicious server advertises a large Content-Length without sending matching data. Adapted from cpython 3.10 backport 5dc101675fd - CVE-2025-13836 * SECURITY UPDATE: command injection in webbrowser.open() via leading dash in URL - debian/patches/CVE-2026-4519.patch: add BaseBrowser._check_url static method that rejects URLs whose lstripped form starts with a dash, and call it at the start of every open() method in GenericBrowser, BackgroundBrowser, UnixBrowser, Konqueror, Grail, WindowsDefault, MacOSX, and MacOSXOSAScript. Adapted from cpython 3.10 backports ad4d5ba32af and 591ed890270; sys.audit() context lines absent in 3.7 (added in 3.8) so the check is inserted as the first statement of each open() - CVE-2026-4519 Important TuxCare License Agreement CVE-2025-13836 CVE-2026-4519 Debian 10 * SECURITY UPDATE: fix off-by-one out-of-bounds read in mod_proxy_ajp message getter functions - debian/patches/CVE-2026-33857-prereq.patch: prerequisite fix for ajp_msg_check_header bounds check to keep msg->len within buffer - debian/patches/CVE-2026-33857.patch: fix off-by-one out-of-bounds read in mod_proxy_ajp message getter functions - CVE-2026-33857 * SECURITY UPDATE: fix improper null termination and out-of-bounds read in ajp_msg_get_string - debian/patches/CVE-2026-34032.patch: fix improper null termination and out-of-bounds read in ajp_msg_get_string - CVE-2026-34032 * SECURITY UPDATE: fix heap buffer over-read in mod_proxy_ajp ajp_parse_data - debian/patches/CVE-2026-34059.patch: fix heap buffer over-read in mod_proxy_ajp ajp_parse_data - CVE-2026-34059 * SECURITY UPDATE: use restricted ap_expr parser in htaccess context to prevent local privilege escalation - debian/patches/CVE-2026-24072.patch: use restricted ap_expr parser in htaccess context to prevent local privilege escalation - CVE-2026-24072 * SECURITY UPDATE: fix NULL pointer dereference crash in mod_dav_lock dav_generic_refresh_locks - debian/patches/CVE-2026-29169.patch: fix NULL pointer dereference crash in mod_dav_lock dav_generic_refresh_locks - CVE-2026-29169 * SECURITY UPDATE: fix timing attack allowing Digest authentication bypass in mod_auth_digest - debian/patches/CVE-2026-33006.patch: fix timing attack allowing Digest authentication bypass in mod_auth_digest - CVE-2026-33006 * SECURITY UPDATE: fix NULL pointer dereference crash in mod_authn_socache - debian/patches/CVE-2026-33007.patch: fix NULL pointer dereference crash in mod_authn_socache - CVE-2026-33007 * SECURITY UPDATE: fix HTTP response splitting via newlines/controls in outgoing status line - debian/patches/CVE-2026-33523.patch: fix HTTP response splitting via newlines/controls in outgoing status line - CVE-2026-33523 Important TuxCare License Agreement CVE-2026-34059 CVE-2026-29169 CVE-2026-33006 CVE-2026-24072 CVE-2026-33523 CVE-2026-33857 CVE-2026-34032 CVE-2026-28780 CVE-2026-33007 Debian 10 * SECURITY UPDATE: XSS within status endpoint in PHP-FPM - debian/patches/CVE-2026-6735.patch: XSS within status endpoint in PHP-FPM - CVE-2026-6735 Moderate TuxCare License Agreement CVE-2026-6735 Debian 10 * SECURITY UPDATE: Use-after-free in readSyncBulkPayload during fullsync - debian/patches/0015-CVE-2026-23631.patch: guard readSyncBulkPayload in src/replication.c with an early return when server.lua_timedout is set, so a fullsync cannot free the Lua scripting engine while a timed-out script is still running on the replica. Backport of upstream redis commit 80c2b5a0a (7.2 branch), adapted to 5.0 by using server.lua_timedout in place of isInsideYieldingLongCommand(). - CVE-2026-23631 Important TuxCare License Agreement CVE-2026-23631 Debian 10 * SECURITY UPDATE: wrong reuse of SMB connection - debian/patches/CVE-2026-5773.patch: disable connection reuse for SMB(S) in lib/smb.c. - CVE-2026-5773 Important TuxCare License Agreement CVE-2026-5773 Debian 10 * SECURITY UPDATE: Denial of service via quadratic attribute-name collision check in libexpat before 2.8.1 - debian/patches/CVE-2026-45186.patch: introduce per-element defaultAttsNames hash table and use it for O(1) attribute collision detection in defineAttribute - CVE-2026-45186 Important TuxCare License Agreement CVE-2026-45186 Debian 10 * CVE-2021-46848: Fix ETYPE_OK off by one array size check. Critical TuxCare License Agreement CVE-2021-46848 Debian 10 * SECURITY UPDATE: integer wraparound on 32-bit systems in palloc() callers - debian/patches/CVE-2026-6473.patch: integer wraparound on 32-bit systems in palloc() callers - CVE-2026-6473 * SECURITY UPDATE: format-string memory disclosure in timeofday() via crafted timezones - debian/patches/CVE-2026-6474.patch: format-string memory disclosure in timeofday() via crafted timezones - CVE-2026-6474 * SECURITY UPDATE: path traversal in pg_rewind allows origin superuser to overwrite local files - debian/patches/CVE-2026-6475.patch: path traversal in pg_rewind allows origin superuser to overwrite local files - CVE-2026-6475 * SECURITY UPDATE: stack buffer overrun in libpq PQfn() (lo_read/lo_lseek64/lo_tell64) - debian/patches/CVE-2026-6477.patch: stack buffer overrun in libpq PQfn() (lo_read/lo_lseek64/lo_tell64) - CVE-2026-6477 * SECURITY UPDATE: covert timing channel in MD5 password comparison - debian/patches/CVE-2026-6478.patch: covert timing channel in MD5 password comparison - CVE-2026-6478 * SECURITY UPDATE: SQL injection and stack buffer overruns in refint contrib module - debian/patches/CVE-2026-6637.patch: SQL injection and stack buffer overruns in refint contrib module - CVE-2026-6637 Low TuxCare License Agreement CVE-2026-6637 CVE-2026-6473 CVE-2026-6474 CVE-2026-6477 CVE-2026-6478 CVE-2026-6475 Debian 10 * SECURITY UPDATE: fix denial of service in mod_md OCSP response handling by enforcing size limit and timeouts - debian/patches/CVE-2026-29168.patch: fix denial of service in mod_md OCSP response handling by enforcing size limit and timeouts - CVE-2026-29168 Important TuxCare License Agreement CVE-2026-29168 Debian 10 * SECURITY UPDATE: Heap buffer overflow in ngx_http_rewrite_module via overlapping PCRE captures in replacement strings - debian/patches/CVE-2026-9256.patch: recompute buffer length per capture (including escaping) in ngx_http_script_regex_start_code to prevent buffer overrun when redirect parameter is used or arguments appear in the rewrite replacement string - CVE-2026-9256 Low TuxCare License Agreement CVE-2026-9256 Debian 10 * SECURITY UPDATE: receiver process memory disclosure via compressed-token integer overflow: - debian/patches/els/0004-CVE-2026-43618.patch: cap rx_token at MAX_TOKEN_INDEX; reject out-of-range token values. - CVE-2026-43618. * SECURITY UPDATE: malicious server can enumerate arbitrary client files via crafted checksum responses: - debian/patches/els/0005-CVE-2024-12086.patch: add secure_relative_open() and route the receiver's basis-file open through it. - CVE-2024-12086. * SECURITY UPDATE: daemon TOCTOU symlink race on parent path components when "use chroot = no": - debian/patches/els/0006-CVE-2026-29518.patch: gate sender/receiver opens and chmods through secure_relative_open() / do_chmod_at(). - CVE-2026-29518. Important TuxCare License Agreement CVE-2026-29518 CVE-2026-43618 CVE-2024-12086 Debian 10 * SECURITY UPDATE: fix out-of-bounds read in urldecode() via signed-char to ctype.h (GHSA-m8rr-4c36-8gq4) - debian/patches/CVE-2026-7258.patch: fix out-of-bounds read in urldecode() via signed-char to ctype.h (GHSA-m8rr-4c36-8gq4) - CVE-2026-7258 Important TuxCare License Agreement CVE-2026-7258 Debian 10 * SECURITY UPDATE: OS command injection in the netrw plugin via crafted sftp:// or file:// URLs - debian/patches/CVE-2026-42307.patch: OS command injection in the netrw plugin via crafted sftp:// or file:// URLs - CVE-2026-42307 Low TuxCare License Agreement CVE-2026-42307 Debian 10 * SECURITY UPDATE: Authentication Bypass in digest authentication - debian/patches/CVE-2026-43512.patch: reject digest authentication attempts for unknown users in getDigest() - CVE-2026-43512 * SECURITY UPDATE: Account lockout bypass in LockOutRealm via case variation of user names - debian/patches/CVE-2026-43513.patch: add a caseSensitive attribute to LockOutRealm and treat user names case-insensitively by default - CVE-2026-43513 * SECURITY UPDATE: Observable timing discrepancy in AJP secret comparison - debian/patches/CVE-2026-43514.patch: add ConstantTime helper and switch the AJP secret comparison to a constant time algorithm - CVE-2026-43514 * SECURITY UPDATE: Improper authorisation when multiple method constraints define an HTTP method for the same extension - debian/patches/CVE-2026-43515.patch: evaluate findMethod() against every matching SecurityCollection rather than only the last one - CVE-2026-43515 * SECURITY UPDATE: Exposure of HTTP authorisation header to unexpected hosts during WebSocket authentication - debian/patches/CVE-2026-42498.patch: drop the cached Authorization header from userProperties before following a WebSocket upgrade redirect so it is not sent to the host named in Location - CVE-2026-42498 * SECURITY UPDATE: HTTP/2 header values were not validated for control characters and other illegal bytes - debian/patches/CVE-2026-41293.patch: validate field names and values in HpackDecoder and HPackHuffman using the new HttpParser isFieldVChar / isFieldContent tables - CVE-2026-41293 * SECURITY UPDATE: Allocation of resources without limits in WebDAV LOCK and PROPFIND request bodies - debian/patches/CVE-2026-41284.patch: read PROPFIND and LOCK bodies through a new BoundedByteArrayOutputStream limited by the new maxRequestBodySize init parameter (default 4096 bytes) - CVE-2026-41284 Low TuxCare License Agreement CVE-2026-43514 CVE-2026-43512 Debian 10 * SECURITY UPDATE: fix stack-based buffer overflow in XTileImage() triggered by a malicious MIFF file when right-clicking a tile to invoke the Load / Update menu item - debian/patches/CVE-2026-42050.patch: fix stack-based buffer overflow in XTileImage() triggered by a malicious MIFF file when right-clicking a tile to invoke the Load / Update menu item - CVE-2026-42050 Low TuxCare License Agreement CVE-2026-42050 Debian 10 * SECURITY UPDATE: receiver use-after-free in receive_xattr() via a wire-supplied xattr count passed to qsort(): - debian/patches/els/0007-CVE-2026-41035.patch: sort temp_xattr.count stored items instead of the untrusted wire count. - CVE-2026-41035. Important TuxCare License Agreement CVE-2026-41035 Debian 10 * SECURITY UPDATE: OS command injection in tar#Vimuntar() in runtime/autoload/tar.vim via crafted .tgz filename (use shellescape(tartail, 1) for :! commands) - debian/patches/CVE-2026-46483.patch: OS command injection in tar#Vimuntar() in runtime/autoload/tar.vim via crafted .tgz filename (use shellescape(tartail, 1) for :! commands) - CVE-2026-46483 Important TuxCare License Agreement CVE-2026-46483 Debian 10 * SECURITY UPDATE: restrict DNS operations (recursion, UPDATE, NOTIFY) to class IN only - debian/patches/CVE-2026-5946.patch: restrict DNS operations (recursion, UPDATE, NOTIFY) to class IN only - CVE-2026-5946 Important TuxCare License Agreement CVE-2026-5946 Debian 10 * SECURITY UPDATE: heap buffer overflow in regex compilation with repeated fixed string on 32-bit builds - debian/patches/fixes/CVE-2026-8376.patch: add SSize_t overflow check before SvGROW in Perl_study_chunk() - CVE-2026-8376 Critical TuxCare License Agreement CVE-2026-8376 Debian 10 * SECURITY UPDATE: make a privilege drop failure before running the mailer fatal - debian/patches/CVE-2026-35535.patch: make a privilege drop failure before running the mailer fatal - CVE-2026-35535 Important TuxCare License Agreement CVE-2026-35535 Debian 10 * SECURITY UPDATE: Insufficient entropy used for hash flooding protection allowing hash flooding via a crafted XML document (libexpat before 2.8.0) - debian/patches/CVE-2026-41080.patch: extract 16 bytes of entropy into a 128-bit SipHash key for hash flooding protection, and add the new XML_SetHashSalt16Bytes() API (backport of upstream PR #1183) - debian/libexpat1.symbols: add XML_SetHashSalt16Bytes - CVE-2026-41080 Low TuxCare License Agreement CVE-2026-41080 Debian 10 * SECURITY UPDATE: Fix stack buffer overrun and SQL injection in refint contrib module - debian/patches/CVE-2026-6637.patch: Fix stack buffer overrun and SQL injection in refint contrib module, plus follow-up segfault fix in check_foreign_key() when a CASCADE update key value is NULL - CVE-2026-6637 * SECURITY UPDATE: Fix format-string memory disclosure via crafted time zone in timeofday() (also harden pg_strftime() error handling) - debian/patches/CVE-2026-6474.patch: Fix format-string memory disclosure via crafted time zone in timeofday() (also harden pg_strftime() error handling) - CVE-2026-6474 * SECURITY UPDATE: Use timingsafe_bcmp() in MD5 password and RADIUS authentication paths to prevent timing side-channel - debian/patches/CVE-2026-6478.patch: Use timingsafe_bcmp() in MD5 password and RADIUS authentication paths to prevent timing side-channel - CVE-2026-6478 Low TuxCare License Agreement CVE-2026-6637 CVE-2026-6474 CVE-2026-6478 Debian 10 * SECURITY UPDATE: named configured for TKEY GSS-API authentication could be driven to excessive memory consumption via crafted TKEY queries (GSS-API context leak on incomplete negotiation) - debian/patches/CVE-2026-3039.patch: named configured for TKEY GSS-API authentication could be driven to excessive memory consumption via crafted TKEY queries (GSS-API context leak on incomplete negotiation) - CVE-2026-3039 Important TuxCare License Agreement CVE-2026-3039 Debian 10 * SECURITY UPDATE: tarfile misinterprets crafted multi-block GNU long name archives via AREGTYPE/DIRTYPE normalization - debian/patches/CVE-2025-13462.patch: skip the old-v7 AREGTYPE to DIRTYPE normalization when reading the follow-up header of a GNU LONGNAME / LONGLINK or PAX member in Lib/tarfile.py - CVE-2025-13462 * SECURITY UPDATE: C stack overflow in pyexpat when an ElementDeclHandler parses a deeply nested content model - debian/patches/CVE-2026-4224.patch: guard conv_content_model() recursion with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() in Modules/pyexpat.c - CVE-2026-4224 * SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding protection - debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak symbol to seed the Expat parser with 16 bytes of entropy when hash randomization is enabled; falls back to the legacy XML_SetHashSalt when unavailable. Requires libexpat1 (>= 2.2.6-2+deb10u7+tuxcare.els6). - CVE-2026-7210 Critical TuxCare License Agreement CVE-2025-13462 CVE-2026-4224 CVE-2026-7210 Debian 10 * SECURITY UPDATE: fix use-after-free of caller-owned BIO in PKCS7_verify() (pk7_smime.c) - debian/patches/CVE-2026-45447.patch: fix use-after-free of caller-owned BIO in PKCS7_verify() (pk7_smime.c) - CVE-2026-45447 Critical TuxCare License Agreement CVE-2026-45447 Debian 10 * SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers - debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7 "AREGTYPE name ending in / is a directory" normalization is no longer applied to a follow-up header based on its truncated name. Prevents a crafted tar archive from being interpreted differently by tarfile than by other tools. Backport of upstream commit 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3 without code changes (the affected functions are structurally identical). Bundles the upstream regression test test_longname_file_not_directory (test_tarfile.py). - CVE-2025-13462 * SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model - debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply nested inline DTD content model parsed by an Expat parser with a registered ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The upstream regression test is not bundled (it needs 3.7-absent test.support helpers and a 500000-deep model); the fix was verified manually. - CVE-2026-4224 * SECURITY UPDATE: control-character injection in http.cookies (HTTP response splitting) - debian/patches/CVE-2026-3644.patch: reject control characters (\x00-\x1F, \x7F) in Lib/http/cookies.py across all Morsel/BaseCookie paths via a new _has_control_character() helper. CVE-2026-3644 is the incomplete-fix follow-up to CVE-2026-0672 and its upstream fix (commit 57e88c1cf9, gh-145599) depends on the helper introduced by the CVE-2026-0672 base commit (95746b3a13, gh-143919). 3.7.3 shipped neither fix, so this patch bundles both: the base validation in Morsel.__setitem__/setdefault/set and BaseCookie.output, plus the follow-up validation in Morsel.update/__setstate__ and BaseCookie.js_output. Also closes CVE-2026-0672. The upstream Morsel.__ior__ override is omitted: it only exists to neutralize dict.__ior__ (PEP 584, Python 3.9+), which 3.7 does not have, so there is no |= bypass to close. The module docstring doctest and the test_basic keebler fixture in test_http_cookies.py are updated to drop a \012 control character now rejected by load(), and the upstream regression tests test_control_characters/test_control_characters_output are bundled with the test.support.control_characters_c0() helper they require. - CVE-2026-3644 Critical TuxCare License Agreement CVE-2025-13462 CVE-2026-3644 CVE-2026-4224 CVE-2026-7210 Debian 10 * SECURITY UPDATE: fix use-after-free in mod_http2 when the server runs out of file handles, which left beam bucket callbacks referencing freed memory - debian/patches/CVE-2026-48913.patch: fix use-after-free in mod_http2 when the server runs out of file handles, which left beam bucket callbacks referencing freed memory - CVE-2026-48913 Critical TuxCare License Agreement CVE-2026-48913 CVE-2026-34355 CVE-2026-42536 CVE-2026-29170 CVE-2026-42535 CVE-2026-29167 CVE-2026-34356 Debian 10 * SECURITY UPDATE: heap buffer over-write in the distributed pixel cache read and write paths - debian/patches/CVE-2026-46692.patch: validate the requested region/length against the pixel-cache extent in the Read and Write DistributeCache functions (ReadDistributeCacheIndexes/Pixels, WriteDistributeCacheIndexes/Pixels) in magick/distribute-cache.c - CVE-2026-46692 Critical TuxCare License Agreement CVE-2026-46692 Debian 10 * SECURITY UPDATE: Code execution via Python omni-completion executing import and from statements harvested from the current buffer through exec() (gate buffer-derived import execution behind the new g:pythoncomplete_allow_import option, disabled by default) - debian/patches/CVE-2026-52858.patch: disable execution of import and from statements found in the buffer during python3complete and pythoncomplete omni-completion unless g:pythoncomplete_allow_import is set - CVE-2026-52858 * SECURITY UPDATE: Out-of-bounds read in update_snapshot() in src/terminal.c when a terminal cell fills all VTERM_MAX_CHARS_PER_CELL slots and the bundled libvterm returns the chars array without a NUL terminator - debian/patches/CVE-2026-52859.patch: bound the cell.chars[] copy loop in update_snapshot() with i < VTERM_MAX_CHARS_PER_CELL to prevent reading past the fixed six-element array - CVE-2026-52859 * SECURITY UPDATE: Code execution via Python omni-completion evaluating function default values, parameter annotations, and class base expressions reconstructed from the current buffer and run through exec() - debian/patches/CVE-2026-52860.patch: strip default expressions and annotations from generated function parameters and whitelist dotted class base expressions in python3complete and pythoncomplete get_code() so attacker-controlled expressions are not executed - CVE-2026-52860 Important TuxCare License Agreement CVE-2026-47162 CVE-2026-52858 CVE-2026-52860 CVE-2026-52859 Debian 10 * SECURITY UPDATE: fix missing dimension check in DCM decoder (invalid image dimensions) - debian/patches/CVE-2026-49218.patch: fix missing dimension check in DCM decoder (invalid image dimensions) - CVE-2026-49218 * SECURITY UPDATE: fix missing maximum memory request check in AcquireAlignedMemory (out-of-memory) - debian/patches/CVE-2026-53460.patch: fix missing maximum memory request check in AcquireAlignedMemory (out-of-memory) - CVE-2026-53460 * SECURITY UPDATE: fix single-byte heap buffer over-write in JP2 coder (jp2:quality / jp2:rate options) - debian/patches/CVE-2026-46559.patch: fix single-byte heap buffer over-write in JP2 coder (jp2:quality / jp2:rate options) - CVE-2026-46559 Important TuxCare License Agreement CVE-2026-46559 CVE-2026-53460 CVE-2026-49218 Debian 10 * SECURITY UPDATE: heap buffer overflow in FTS5 corrupt-record handling - debian/patches/CVE-2026-11822-and-11824.patch: reject leaf pages with szLeaf < 4 in fts5LeafRead() in ext/fts5/fts5_index.c, closing the out-of-bounds read / heap buffer overflow paths in fts5ChunkIterate() and fts5LeafSeek(). - CVE-2026-11822 - CVE-2026-11824 Important TuxCare License Agreement CVE-2026-11824 CVE-2026-11822 Debian 10 * SECURITY UPDATE: NULL pointer dereference in HPACK dynamic table insertion - debian/patches/CVE-2026-55204.patch: add missing NULL check after hpack_dht_defrag() in hpack_dht_insert() in src/hpack-tbl.c - CVE-2026-55204 Important TuxCare License Agreement CVE-2026-55204 Debian 10 * SECURITY UPDATE: Out-of-bounds write in tree_count_words() in src/spellfile.c when a crafted .spl/.sug spell-file pair loaded during spell suggestion drives the word-trie descent past the end of the MAXWLEN-sized arridx, curi and wordcount stack arrays - debian/patches/CVE-2026-55693.patch: bound the descent in tree_count_words() and sug_filltree() with depth < MAXWLEN - 1, matching the sibling trie walkers, so the depth index can no longer run past the fixed MAXWLEN-sized arrays - CVE-2026-55693 * SECURITY UPDATE: Out-of-bounds write in spell_soundfold_sofo() in src/spell.c when a word longer than MAXWLEN is sound-folded through a spell file's SOFO byte map while a SOFO-based spell language is active, writing past the end of the caller's MAXWLEN-sized result buffer - debian/patches/CVE-2026-57455.patch: bound the single-byte SOFO translation loop in spell_soundfold_sofo() with ri < MAXWLEN - 1 so the output index can no longer run past the fixed MAXWLEN-sized result buffer - CVE-2026-57455 * SECURITY UPDATE: Code execution via Python omni-completion inserting buffer-derived docstrings verbatim between triple quotes in the reconstructed source run through exec(), letting a crafted docstring break out of the triple-quoted literal and execute attacker-controlled code - debian/patches/CVE-2026-57456.patch: use repr() to quote docstrings in the Scope, Class, and Function get_code() methods of python3complete and pythoncomplete so docstring text can no longer break out of the generated string literal - CVE-2026-57456 Important TuxCare License Agreement CVE-2026-57456 CVE-2026-57455 CVE-2026-55693 Debian 10 * SECURITY UPDATE: Stack out-of-bounds write in dump_prefixes() in src/spell.c during :spelldump when a crafted spell file containing a self-referential BY_INDEX node in the prefix tree drives the descent depth past the MAXWLEN-sized prefix[]/arridx[]/curi[] stack arrays - debian/patches/CVE-2026-55892.patch: bound the prefix-tree descent in dump_prefixes() with "else if (depth < MAXWLEN - 1)" so the depth index cannot exceed the MAXWLEN-sized stack arrays - CVE-2026-55892 Moderate TuxCare License Agreement CVE-2026-55892 Debian 10 * SECURITY UPDATE: infinite loop in mod_proxy_ftp Retry-After parsing - debian/patches/CVE-2026-44186.patch: advance the scan pointer while searching for the delta-seconds digit in an FTP error response Retry-After header in modules/proxy/mod_proxy_ftp.c so the loop terminates instead of spinning forever - CVE-2026-44186 Important TuxCare License Agreement CVE-2026-44186 Debian 10 * SECURITY UPDATE: fix remote command execution via unescaped %u in 'check password script' - debian/patches/CVE-2026-4408.patch: fix remote command execution via unescaped %u in 'check password script' - CVE-2026-4408 Critical TuxCare License Agreement CVE-2026-4408 Debian 10 * SECURITY UPDATE: stack buffer overflows in xmlcatalog --shell mode - debian/patches/CVE-2026-11979.patch: add bounds checks in the usershell() command-line parser in xmlcatalog.c to prevent stack buffer overflows when parsing overly long command lines - CVE-2026-11979 Important TuxCare License Agreement CVE-2026-11979 Debian 10 * SECURITY UPDATE: memory allocation with excessive size value (DoS) in mod_http2 HTTP/2 cookie header merging - debian/patches/CVE-2026-49975.patch: count merged cookie headers as an add so they keep counting against LimitRequestFields, and ignore duplicate empty cookie headers, in req_add_header() in modules/http2/h2_util.c; otherwise repeated HTTP/2 cookie headers merge into one growing value without tripping the LimitRequestFields guard, letting a single stream drive unbounded memory allocation. Upstream fix 35c6e405390ed361189a82acd96675401ea5947c (SVN r1934882). - CVE-2026-49975 Important TuxCare License Agreement CVE-2026-49975 Debian 10 * SECURITY UPDATE: buffer underwrite in ap_regname() regex capture handling - debian/patches/CVE-2026-44631.patch: cast the PCRE name-table bytes to unsigned char in ap_regname() so the capture group number cannot become negative, and reject capture numbers above 1024, in server/util_pcre.c; check the return value in the <Directory>, <Location>, <Files> and <Proxy> section handlers in server/core.c and modules/proxy/mod_proxy.c - CVE-2026-44631 Important TuxCare License Agreement CVE-2026-44631 Debian 10 * SECURITY UPDATE: out-of-bounds read when writing an IPTC output file (single-byte over-read) - debian/patches/CVE-2026-42326.patch: tighten the IPTC tag-length bound check in GetIPTCStream() in coders/meta.c - CVE-2026-42326 * SECURITY UPDATE: out-of-bounds over-read of 24 bytes during polynomial distortion - debian/patches/CVE-2026-45624.patch: validate the control-point argument count in GenerateCoefficients() in magick/distort.c - CVE-2026-45624 * SECURITY UPDATE: out-of-bounds write in the MIFF encoder when using LZMA compression - debian/patches/CVE-2026-46521.patch: include LZMAMaxExtent in the buffer-length computation and fail on LZMA-encoder errors in WriteMIFFImage() in coders/miff.c - CVE-2026-46521 * SECURITY UPDATE: stack overflow via a crafted MVG file (missing recursion-depth check) - debian/patches/CVE-2026-48734.patch: add a recursion-depth guard on nested MVG class expansion in RenderMVGContent() in magick/draw.c - CVE-2026-48734 * SECURITY UPDATE: heap buffer over-write in the MAT decoder on 32-bit systems (missing return-value check) - debian/patches/CVE-2026-48994.patch: check the quantum-format setters' return values and bail out on failure in ReadMATImageV4() in coders/mat.c - CVE-2026-48994 * SECURITY UPDATE: complete the CVE-2026-45664 MNG LOOP/ENDL loop-cap fix by releasing the chunk buffer before raising the resource-limit exception (heap memory leak on the loop-cap abort path) - debian/patches/CVE-2026-45664-1.patch: free chunk before both ThrowReaderException calls in ReadOneMNGImage() in coders/png.c - CVE-2026-45664 Important TuxCare License Agreement CVE-2026-46523 CVE-2026-46520 CVE-2026-46522 CVE-2026-48994 CVE-2026-42326 CVE-2026-45624 CVE-2026-46521 CVE-2026-48734 CVE-2026-45031 CVE-2026-33901 CVE-2026-33908 CVE-2026-45664 Debian 10 * SECURITY UPDATE: out-of-bounds read in the LZH decoder from stale shared decompression state (left/right) reused across a .Z then .lzh member in a single gzip -d invocation - debian/patches/CVE-2026-41992.patch: clear left/right when n == 0 in read_c_len() in unlzh.c - CVE-2026-41992 Important TuxCare License Agreement CVE-2026-41992 Debian 10 * SECURITY UPDATE: image depth mishandled after SetQuantumFormat in the MIFF reader (out-of-bounds read on crafted image) - debian/patches/CVE-2025-43965.patch: update image->depth from the quantum format's depth after SetQuantumFormat() in ReadMIFFImage() in coders/miff.c - CVE-2025-43965 Important TuxCare License Agreement CVE-2025-43965 Debian 10 * SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: the typeref/typename tag field is interpolated unescaped into the :vimgrep pattern in s:StructMembers() in runtime/autoload/ccomplete.vim, so a crafted tags file can close the search pattern and append an arbitrary Ex command when completing a struct/union member - debian/patches/CVE-2026-59858.patch: wrap the type field with escape(typename, '/\') before inserting it into the :vimgrep pattern in s:StructMembers() so it can no longer close the search pattern and start a new Ex command - CVE-2026-59858 Important TuxCare License Agreement CVE-2026-59858 Debian 10 * SECURITY UPDATE: fix integer overflow in Content-Range header parsing in src/http.c - debian/patches/CVE-2026-58470.patch: fix integer overflow in Content-Range header parsing in src/http.c - CVE-2026-58470 * SECURITY UPDATE: fix heap buffer overflow in filename charset conversion (convert_fname) in src/url.c - debian/patches/CVE-2026-58471.patch: fix heap buffer overflow in filename charset conversion (convert_fname) in src/url.c - CVE-2026-58471 * SECURITY UPDATE: fix integer/heap buffer overflow in HTML attribute entity encoding (html_quote_string) in src/convert.c - debian/patches/CVE-2026-58472.patch: fix integer/heap buffer overflow in HTML attribute entity encoding (html_quote_string) in src/convert.c - CVE-2026-58472 Important TuxCare License Agreement CVE-2026-58472 CVE-2026-58471 CVE-2026-58470 Debian 10 * SECURITY UPDATE: potential multiplication overflow in the publickey subsystem leading to a heap buffer overflow on 32-bit platforms - debian/patches/CVE-2026-58050.patch: cap the publickey attribute count at 1024, and zero-initialise the freshly (re)allocated list entry before parsing to avoid a free of uninitialised memory on the new bounds-check error path, in libssh2_publickey_list_fetch() in src/publickey.c - CVE-2026-58050 Important TuxCare License Agreement CVE-2026-58050 Debian 10 * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations in incremental parsing - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and parse it once enough has piled up, avoiding the quadratic rescanning and concatenation of an unterminated construct across feed() calls in Lib/HTMLParser.py - CVE-2026-15308 Important TuxCare License Agreement CVE-2026-15308 Debian 10 * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and rescan it once a growing threshold is reached, so an unterminated construct (tag, comment, PI, doctype, CDATA, RAWTEXT element) spread across many feed() calls no longer makes both the buffer concatenation and the rescan quadratic in the input size (backport of upstream commit bcf98ddbc40e, gh-153030 / GH-153031). - CVE-2026-15308 Important TuxCare License Agreement CVE-2026-15308 Debian 10 * SECURITY UPDATE: One-byte heap under-read in GKeyFile locale string list - debian/patches/CVE-2026-58014.patch: guard len > 0 before reading value[len - 1] when a key has an empty value in g_key_file_get_locale_string_list() in glib/gkeyfile.c - CVE-2026-58014 * SECURITY UPDATE: Path traversal via unvalidated D-Bus cookie context - debian/patches/CVE-2026-58015.patch: validate the server-supplied cookie_context (reject path-traversal characters) and harden cookie_id validation in the DBUS_COOKIE_SHA1 client authentication mechanism in gio/gdbusauthmechanismsha1.c - CVE-2026-58015 Critical TuxCare License Agreement CVE-2026-58015 CVE-2026-58014 CVE-2026-58016 Debian 10 * SECURITY UPDATE: off-by-one out-of-bounds read in morphology kernel validation - debian/patches/CVE-2026-56361.patch: reject a User Defined kernel origin equal to the kernel width/height in magick/morphology.c - CVE-2026-56361 * SECURITY UPDATE: integer overflow leading to heap out-of-bounds read in the PSD/PSB RLE decoder - debian/patches/CVE-2026-56367.patch: guard the image->rows*psd_info->channels allocation size against integer overflow in ReadPSDMergedImage() in coders/psd.c - CVE-2026-56367 * SECURITY UPDATE: memory leak in coders that write raw pixel data - debian/patches/CVE-2026-56368.patch: free quantum_info on the OpenBlob failure paths in coders/bgr.c, cmyk.c, gray.c, rgb.c and ycbcr.c - CVE-2026-56368 * SECURITY UPDATE: out-of-bounds access in ConnectedComponentsImage() - debian/patches/CVE-2026-56370.patch: validate the CLI connected-components:keep / :remove indices before indexing object[]/colormap[] in magick/vision.c - CVE-2026-56370 * SECURITY UPDATE: heap out-of-bounds read/write in the PCD decoder - debian/patches/CVE-2026-56378.patch: bound the write pointer against a per-plane sentinel in DecodeImage() in coders/pcd.c - CVE-2026-56378 Critical TuxCare License Agreement CVE-2026-56361 CVE-2026-56368 CVE-2026-56370 CVE-2026-56367 CVE-2026-56378 Debian 10 * SECURITY UPDATE: out-of-bounds read in the FTP gateway directory-listing parser when a TypeA/TypeB listing entry date is not followed by a filename - debian/patches/CVE-2026-47729.patch: restrict parsing to the input buffer in ftpListParseParts() by checking for a NUL byte before strchr(w_space) in src/clients/FtpGateway.cc - CVE-2026-47729 * SECURITY UPDATE: heap-based buffer overflow in cache digest reply handling when a peer reply's on-the-wire size exceeds the declared mask_size - debian/patches/CVE-2026-50012.patch: bound-check mask_offset + size against mask_size before memcpy() in peerDigestSwapInMask() and abort the fetch on overflow in src/peer_digest.cc - CVE-2026-50012 Moderate TuxCare License Agreement CVE-2026-47729 CVE-2026-50012 Debian 10 * SECURITY UPDATE: pre-authentication denial of service via GSSAPI - debian/patches/CVE-2026-60000.patch: discard GSSAPI error tokens in auth2-gss.c instead of feeding them into the GSSAPI stack, and count the failed attempt so GSSAPI auth is subject to MaxAuthTries. - CVE-2026-60000 Important TuxCare License Agreement CVE-2026-60000 Debian 10 * SECURITY UPDATE: memory leak in the VIFF encoder on colormap allocation failure - debian/patches/CVE-2026-61870.patch: relinquish pixel_info before throwing when the colormap allocation fails in WriteVIFFImage() in coders/viff.c - CVE-2026-61870 * SECURITY UPDATE: memory leak in the TIFF encoder when a temporary file cannot be created - debian/patches/CVE-2026-61863.patch: destroy huffman_image on the temporary-file failure path in WriteGROUP4Image() in coders/tiff.c - CVE-2026-61863 Important TuxCare License Agreement CVE-2026-61870 CVE-2026-61863 Debian 10 * SECURITY UPDATE: JNDIRealm bypass when configured with GSSAPI authentication - HttpServletRequest.login(username, password) calls validated credentials via the GSSAPI SASL mechanism instead of a plain LDAP bind, silently accepting arbitrary passwords - debian/patches/CVE-2026-55957.patch: preserve DirContext environment, drop the GSSAPI SECURITY_AUTHENTICATION setting before the user-credential bind, and restore it in a finally block via the existing restoreEnvironmentParameter() helper - CVE-2026-55957 Important TuxCare License Agreement CVE-2026-55957 Debian 10 * SECURITY UPDATE: DisableForwarding did not override PermitTunnel - debian/patches/CVE-2026-59999.patch: reject tunnel-device forwarding requests in server_request_tun() (serverloop.c) when DisableForwarding is set, so it takes precedence over PermitTunnel. - CVE-2026-59999 Important TuxCare License Agreement CVE-2026-59999 Debian 10 * SECURITY UPDATE: Heap buffer overflow in ngx_http_grpc_module when proxying oversized headers to a gRPC/HTTP/2 upstream - debian/patches/CVE-2026-42055.patch: reject request line and header fields longer than NGX_HTTP_V2_MAX_FIELD in ngx_http_grpc_create_request to prevent buffer overrun when large_client_header_buffers exceeds 2 megabytes and ignore_invalid_headers is off - CVE-2026-42055 Important TuxCare License Agreement CVE-2026-42055 Debian 10 * SECURITY UPDATE: fix authentication bypass in cupsd caused by dispatching on the client-supplied Authorization scheme without checking it against the configured AuthType. - debian/patches/CVE-2025-58060.patch: reject "Authorization: Basic" unless the effective AuthType is CUPSD_AUTH_BASIC and "Authorization: Negotiate" unless it is CUPSD_AUTH_NEGOTIATE in cupsdAuthorize() in scheduler/auth.c. - CVE-2025-58060. * Fix cupsd failing to start with "cupsdDoSelect() failed - Bad address!" on hosts whose RLIMIT_NOFILE hard limit is very large but not RLIM_INFINITY, where the epoll event array allocation fails. - debian/patches/maxfds-limit.patch: cap MaxFDs at 65535 in scheduler/main.c, backported from upstream Issue #989. Important TuxCare License Agreement CVE-2025-58060 Debian 10 * SECURITY UPDATE: uncontrolled recursion leading to stack overflow via crafted XPath expressions - debian/patches/CVE-2025-9714.patch: Make XPath depth check work with recursive invocations to prevent stack overflows - CVE-2025-9714 Important TuxCare License Agreement CVE-2025-32414 CVE-2025-32415 CVE-2022-49043 CVE-2025-6021 CVE-2024-25062 CVE-2025-27113 Debian 10 * SECURITY UPDATE: Heap buffer overflow in get_tagfname() in src/tag.c: the user-settable 'helpfile' option value is copied into a fixed MAXPATHL+1-sized heap buffer with an unbounded STRCPY() when help-file tags are resolved, so a 'helpfile' path longer than MAXPATHL writes past the end of the buffer - debian/patches/CVE-2026-25749.patch: replace the unbounded STRCPY(buf, p_hf) in get_tagfname() with a bounded vim_strncpy() that also leaves room for the "tags" tail appended by the following STRCPY(gettail(buf), "tags"), so the 'helpfile' value can no longer be copied past the end of the caller's MAXPATHL-sized buffer - CVE-2026-25749 * SECURITY UPDATE: Modeline sandbox bypass allowing arbitrary OS command execution when a crafted file is opened: the 'complete', 'guitabtooltip' and 'printheader' options are missing the P_MLE flag, so a modeline can set them to expressions that are evaluated outside the 'modelineexpr' guard - debian/patches/CVE-2026-34982.patch: add the P_MLE flag to the 'complete', 'guitabtooltip' and 'printheader' entries of the option table in src/option.c so a modeline can no longer set them while 'modelineexpr' is off; the upstream mapset() hunk is dropped as mapset() does not exist in 8.1.0875 - CVE-2026-34982 * SECURITY UPDATE: Command injection during tag resolution in expand_tag_fname() in src/tag.c: the filename field read from a tags file is passed to ExpandOne() for wildcard and environment-variable expansion, so a crafted tags file containing backtick syntax makes vim execute the embedded command through the shell with the user's privileges - debian/patches/CVE-2026-41411.patch: guard the wildcard expansion in expand_tag_fname() with vim_strchr(fname, '`') == NULL so a tags-file filename field containing backticks is never handed to ExpandOne() and can no longer reach the shell - CVE-2026-41411 Important TuxCare License Agreement CVE-2026-41411 CVE-2026-34982 CVE-2026-25749 Debian 10 * SECURITY UPDATE: potential SSRF in mod_rewrite via RewriteRule substitutions that produce a scheme-like target - debian/patches/CVE-2024-39573.patch: add the previously stripped per-directory prefix, or an implicit '/' root prefix, to the substituted URI before the query args are split in apply_rewrite_rule() in modules/mappers/mod_rewrite.c; otherwise a rule such as "RewriteRule ^/some/path(.*) $1" turns "/some/pathscheme:..." into the fully qualified URL "scheme:...", which mod_proxy then handles. Upstream fix 93aec0e3ca451bcc97f6d91c14d5399d13a73365 (SVN r1918600). - CVE-2024-39573 * SECURITY UPDATE: insufficient escaping of mod_ssl variables written to the log by CustomLog - debian/patches/CVE-2024-47252.patch: pass the results of ssl_var_log_handler_c() and ssl_var_log_handler_x() through ap_escape_logitem() in modules/ssl/ssl_engine_vars.c, so an untrusted TLS client can no longer insert escape characters into log files through the %{varname}c and %{varname}x formats logging mod_ssl variables such as SSL_TLS_SNI. Upstream fix c01e60707048be14a510f0a92128a5227923215c (SVN r1927042). - CVE-2024-47252 * SECURITY UPDATE: access control bypass by trusted clients through TLS 1.3 session resumption in mod_ssl - debian/patches/CVE-2025-23048.patch: move the ssl_server_compatible() check in ssl_hook_ReadReq() in modules/ssl/ssl_engine_kernel.c out of the SNI-present branch, so the handshake virtual host and the request virtual host are compared even when the client sent no SNI, as happens on a resumed TLS 1.3 session; previously such a request could reach a virtual host with different client certificate restrictions when SSLStrictSNIVHostCheck was off. Upstream fix c4cfa50c9068e8b8134c530ab21674e77d1278a2 (SVN r1927043). - CVE-2025-23048 * SECURITY UPDATE: denial of service through an assertion failure in mod_proxy_http2 - debian/patches/CVE-2025-49630.patch: fall back to the server hostname when ProxyPreserveHost is on but the incoming request carried no Host: header, in open_stream() in modules/http2/h2_proxy_session.c, instead of passing a NULL authority on to the HTTP/2 backend and tripping an assertion. Upstream fix 88304321841a2fe8bd5eacc70e69418b0b545ca5 (SVN r1927044). - CVE-2025-49630 * SECURITY UPDATE: query string passed by mod_cgid to Server Side Includes #exec cmd= commands - debian/patches/CVE-2025-58098.patch: pass NULL instead of r->args to create_argv() for SSI_REQ requests in cgid_server(), and tolerate a NULL args in create_argv(), in modules/generators/mod_cgid.c; otherwise the shell-escaped query string is appended as arguments to the command line of an SSI "#exec cmd=..." directive. Upstream fix ecc1b8f3817e3dcab9c1f24f905752d3c0a279af (SVN r1930161). - CVE-2025-58098 * SECURITY UPDATE: integer overflow in the mod_md ACME renewal backoff timer - debian/patches/CVE-2025-55753.patch: double the retry delay step by step with an overflow and cap check in md_job_delay_on_errors() in modules/md/md_status.c instead of shifting job->min_delay left by err_count-1 in one go; otherwise after roughly 30 days of consecutive renewal failures the shift wraps the signed apr_time_t, the backoff collapses to 0 and the server retries against the ACME CA in a tight loop. Upstream fix 20666cfb765b8ad14efa3d97bc92d344b9395c89 (SVN r1929515). - CVE-2025-55753 Important TuxCare License Agreement CVE-2024-39573 CVE-2025-55753 CVE-2025-49630 CVE-2025-23048 CVE-2025-58098 CVE-2024-47252 Debian 10 * SECURITY UPDATE: Security constraint bypass in the RewriteValve - the decoded and normalized request URI used for subsequent security constraint matching was produced with java.net.URLDecoder.decode(), which applies form-encoding rules and converts '+' to a space instead of performing proper URI percent-decoding - debian/patches/CVE-2026-59083.patch: use Tomcat's UDecoder.URLDecode() (already imported and used elsewhere in the class) instead of java.net.URLDecoder.decode() to build the decoded request URI - CVE-2026-59083 Moderate TuxCare License Agreement CVE-2026-59083 Debian 10 * SECURITY UPDATE: configuration file injection via carriage returns in written option values - debian/patches/CVE-2026-0864.patch: normalise CR and CRLF, and not only LF, into '\n\t' continuation lines when writing option values in RawConfigParser.write() in Lib/ConfigParser.py, so that an attacker-controlled value can no longer inject additional sections, keys and values into the written file - CVE-2026-0864 * SECURITY UPDATE: CPU denial-of-service in tarfile streaming mode via a member size declared past the end of the stream - debian/patches/CVE-2026-11972.patch: stop _Stream.seek() at the first empty read instead of looping once per attacker-declared block against an already-exhausted stream in Lib/tarfile.py - CVE-2026-11972 Important TuxCare License Agreement CVE-2026-0864 CVE-2026-11972 Debian 10 * SECURITY UPDATE: heap-based buffer overflow in xcoff_link_add_symbols (bfd/xcofflink.c) triggered by a crafted XCOFF object file - debian/patches/CVE-2026-6846.patch: size the reloc_info array by the highest section target_index rather than by section_count, which the XCOFF overflow-header handling decrements - CVE-2026-6846 Important TuxCare License Agreement CVE-2026-6846 Debian 10 * SECURITY UPDATE: Integer overflow in doProlog related to storeEntityValue and entity textLen (libexpat before 2.8.2) - debian/patches/CVE-2026-56407.patch: cap the entity value pool length at INT_MAX before assigning it to the signed ENTITY::textLen in doProlog - CVE-2026-56407 * SECURITY UPDATE: Integer overflow in copyString (libexpat before 2.8.2) - debian/patches/CVE-2026-56408.patch: reject lengths above SIZE_MAX / sizeof(XML_Char) before sizing the copy, closing the multiplication overflow in wide-character (libexpatw) builds - CVE-2026-56408 * SECURITY UPDATE: Integer overflow for the output filename in xmlwf when -d outputDir is used (libexpat before 2.8.2) - debian/patches/CVE-2026-56409.patch: check the output path join for addition and multiplication overflow, and check the malloc result, before writing the joined path - CVE-2026-56409 Important TuxCare License Agreement CVE-2026-56408 CVE-2026-56409 CVE-2026-56407 Debian 10 * SECURITY UPDATE: information leak of uninitialized stack memory via an attacker-controlled checksum length (s2length) in hash_search(): - debian/patches/els/0008-CVE-2024-12085.patch: zero the local sum2 buffer on entry to hash_search(). - CVE-2024-12085. Important TuxCare License Agreement CVE-2024-12085 Debian 10 * SECURITY UPDATE: Archive::Tar extracted symlinks and hardlinks with attacker-controlled targets outside the extraction directory - debian/patches/fixes/CVE-2026-42496.patch: reject absolute and '..'-traversing link targets in Archive::Tar::_make_special_file() unless $Archive::Tar::INSECURE_EXTRACT_MODE is set - CVE-2026-42496 * SECURITY UPDATE: arbitrary code execution in File::GlobMapper via an attacker-controlled output glob - debian/patches/fixes/CVE-2026-48962.patch: replace the eval STRING in File::GlobMapper::_getFiles() with explicit substitution of internal wildcard markers, so no part of the output glob is evaluated as Perl - CVE-2026-48962 Critical TuxCare License Agreement CVE-2026-48962 CVE-2026-42496 Debian 10 * SECURITY UPDATE: out-of-bounds write in the internal DNS server via a TSIG-signed packet using DNS name compression - debian/patches/CVE-2026-6949.patch: record the start offset of each dns_res_rec while pulling it and use the last additional record's offset to truncate the buffer for TSIG verification, instead of subtracting a re-pushed TSIG record length that can exceed the packet and underflow packet_len into a huge memcpy() size - CVE-2026-6949 Important TuxCare License Agreement CVE-2026-6949 Debian 10 * Fix armel build under qemu-user emulation: skip process-title and threaded directory-handle tests that cannot pass under qemu-arm-static - debian/patches/debian/armel-skip-qemu-emulation-tests.diff: guard the argv[0]/$0 assertions in t/op/magic.t and dist/threads/t/join.t and the cloned-dir-iterator assertion in t/op/threads-dirh.t on the armel archname (arm-linux-gnueabi*), so amd64/arm64 keep running them Critical TuxCare License Agreement CVE-2026-57432 CVE-2026-13221 Debian 10 * SECURITY UPDATE: Use-after-free of a pending dedicated ACK buffer when a TLS session is freed during session promotion or expiry - debian/patches/CVE-2026-12996.patch: add the check_session_buf_not_used() safeguard, including its ks->ack_write_buf check, and call it before every site in tls_multi_process() that frees or resets a session - CVE-2026-12996 - the safeguard does not exist in 2.4.7, so it is introduced here already in its post-CVE-2026-12996 form; as a result this patch also fixes CVE-2026-40215, which shares the same safeguard Important TuxCare License Agreement CVE-2026-12996 Debian 10 * SECURITY UPDATE: Denial of service in HTTP/2 - a stream could be removed from the count of active streams more than once, driving the count below the real value, so an infinite connection timeout was applied and connections that should have been closed stayed open - debian/patches/CVE-2024-34750.patch: guard each stream with an AtomicBoolean so that it is removed from the active stream count at most once, and route the decrements through the new decrementActiveRemoteStreamCount(Stream) helper - CVE-2024-34750 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - on a case insensitive file system a race between a read and a concurrent write for the same path allowed an uploaded file to be picked up and compiled as a JSP - debian/patches/CVE-2024-50379.patch: add the WebResourceLockSet interface and serialise reads and writes for the same resource path in DirResourceSet and FileResource through a per-path read/write lock - CVE-2024-50379 * SECURITY UPDATE: Authentication bypass when a custom Jakarta Authentication component throws an exception without setting an HTTP status, leaving the response status at 200 - debian/patches/CVE-2024-52316.patch: explicitly set a 500 status in authenticateJaspic() when validateRequest() throws an AuthException - CVE-2024-52316 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - the mitigation for CVE-2024-50379 was incomplete because the JVM global canonical file name cache could still return a stale result for the concurrently written path - debian/patches/CVE-2024-56337.patch: disable the canonical file name cache before a potentially exposed WebResourceSet starts and refuse to start it if that cannot be confirmed, add Jre12Compat and Jre21Compat for the per Java version cache behaviour, and pass -Dsun.io.useCanonCaches=false from catalina.sh - CVE-2024-56337 * SECURITY UPDATE: Denial of service in HTTP/2 (MadeYouReset) - frames that make the server reset a stream were not counted against the connection overhead budget, so the CVE-2023-44487 mitigation never triggered - debian/patches/CVE-2025-48989.patch: count every RST_STREAM frame Tomcat sends using overheadResetFactor - CVE-2025-48989 * SECURITY UPDATE: Directory traversal via the RewriteValve, with possible remote code execution if PUT is enabled - the rewritten URL was normalized while still percent encoded, so an encoded ../ survived normalization and was decoded afterwards, letting the request escape into /WEB-INF/ or /META-INF/ - debian/patches/CVE-2025-55752.patch: decode the rewritten URL before normalizing it, and reject the request with a 400 when normalization reports that the path escapes root - CVE-2025-55752 * SECURITY UPDATE: Padding oracle in the cluster EncryptInterceptor - the interceptor accepted cipher mode and padding combinations that offer no protection, and the CBC modes it accepted are malleable and open to a padding oracle - debian/patches/CVE-2026-29146.patch: reject the cipher mode and padding combinations that offer no protection, warn for the CBC, CFB and OFB modes with PKCS5Padding that are kept for compatibility, and recognise GCM/NoPadding as the recommended transformation. The patch also carries the upstream partial revert 776e12b3, without which the fix would reintroduce CVE-2026-34486 by passing messages that failed to decrypt up the interceptor chain with their raw bytes. Note that, as upstream, explicit EncryptInterceptor configurations using a mode that offers no protection (NONE, ECB, PCBC, CTS, KW, KWP, CTR, and CBC, CFB or OFB with NoPadding) are now rejected at startup. The default AES/CBC/PKCS5Padding keeps working and only logs a recommendation to switch to AES/GCM/NoPadding - CVE-2026-29146 Important TuxCare License Agreement CVE-2024-34750 CVE-2024-56337 CVE-2024-52316 CVE-2024-50379 CVE-2025-55752 CVE-2025-48989 CVE-2026-29146 Debian 10 * SECURITY UPDATE: stale custom cookie host causes cookie leak - debian/patches/CVE-2026-6276.patch: clear the remembered custom Host: name at the start of every request in lib/http.c. - CVE-2026-6276 * SECURITY UPDATE: wrong STARTTLS connection reuse - debian/patches/CVE-2026-8286.patch: require a matching SSL configuration when reusing a connection for a transfer that may upgrade to TLS in lib/url.c. - CVE-2026-8286 * SECURITY UPDATE: env-set cross-proxy Digest auth state leak - debian/patches/CVE-2026-8927.patch: flush the proxy Digest state when the proxy read from the environment changes in lib/url.c, lib/urldata.h. - CVE-2026-8927 * SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS session cache - debian/patches/CVE-2026-8932.patch: include the client private key options in the primary SSL config so connection reuse and the TLS session cache compare them in lib/url.c, lib/urldata.h, lib/vtls/vtls.c. - CVE-2026-8932 * SECURITY UPDATE: HTTP/2 push headers memory leak - debian/patches/CVE-2024-2398.patch: free the whole set of push headers on the array-growth failure path in lib/http2.c. - CVE-2024-2398 Important TuxCare License Agreement CVE-2026-6276 CVE-2026-8927 CVE-2024-2398 CVE-2026-8932 CVE-2026-8286 Debian 10 * SECURITY UPDATE: unbounded recursion via circular symlinks in phar archives - debian/patches/CVE-2026-7260.patch: unbounded recursion via circular symlinks in phar archives - CVE-2026-7260 * SECURITY UPDATE: SQL injection in ext/pgsql via E'...' backslash breakout - debian/patches/CVE-2026-17543.patch: SQL injection in ext/pgsql via E'...' backslash breakout - CVE-2026-17543 Critical TuxCare License Agreement CVE-2026-17543 CVE-2026-7260 Debian 10 * SECURITY UPDATE: Out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates in the *_toUtf16 functions (libexpat before 2.8.3) - debian/patches/CVE-2026-72522.patch: mask the high byte with 0xFC instead of 0xF8 so the split-surrogate guard in DEFINE_UTF16_TO_UTF16 matches only genuine high surrogates (0xD800-0xDBFF) and no longer accepts low ones (0xDC00-0xDFFF); also carries upstream's regression test into tests/runtests.c (2.2.6 has no tests/misc_tests.c), which exercises the wide -DXML_UNICODE build only - CVE-2026-72522 Important TuxCare License Agreement CVE-2026-72522 Debian 10 * SECURITY UPDATE: use-after-free in the awk sub()/gsub()/gensub() replacement string - debian/patches/CVE-2026-38753.patch: awk: copy the replacement string before evaluating the regex argument in awk_sub() - CVE-2026-38753 * SECURITY UPDATE: out-of-bounds read in the ash IFS splitting code - debian/patches/CVE-2026-38754.patch: ash: release stale IFS region state when an expansion error is caught in redirectsafe() - CVE-2026-38754 Moderate TuxCare License Agreement CVE-2026-38754 CVE-2026-38753 Debian 10 * SECURITY UPDATE: uncontrolled recursion in SGML catalog parsing - debian/patches/CVE-2025-8732.patch: thread a depth counter through xmlParseSGMLCatalog() and xmlExpandCatalog() in catalog.c and bail out past MAX_CATAL_DEPTH, and register expanded catalog filenames in the SGML hash table before recursing so a repeated CATALOG directive is only followed once, to prevent stack exhaustion and exponential re-parsing on self-referencing SGML CATALOG entries. Add test files result/catalogs/recursive, test/catalogs/recursive.script and test/catalogs/recursive.sgml - CVE-2025-8732 * SECURITY UPDATE: uncontrolled recursion in the RelaxNG parser via nested schema includes - debian/patches/CVE-2026-0989.patch: add an include depth limit to the RelaxNG parser context in relaxng.c, defaulting to 1000 and overridable via the RNG_INCLUDE_LIMIT environment variable or the new xmlRelaxParserSetIncLImit() entry point in include/libxml/relaxng.h, and make xmlRelaxNGIncludePush() failures propagate. Add coverage in runtest.c and test/relaxng/include/include-limit*.rng - debian/libxml2.symbols: add the new xmlRelaxParserSetIncLImit symbol - CVE-2026-0989 * SECURITY UPDATE: uncontrolled recursion in XML catalog URI resolution - debian/patches/CVE-2026-0990.patch: add a MAX_CATAL_DEPTH guard to xmlCatalogListXMLResolveURI() in catalog.c and stop clobbering the catalog entry used for depth bookkeeping while walking the entry list, to prevent stack exhaustion on a self-referencing delegateURI entry - CVE-2026-0990 * SECURITY UPDATE: uncontrolled resource consumption via repeated nextCatalog entries - debian/patches/CVE-2026-0992.patch: ignore duplicate nextCatalog entries in xmlParseXMLCatalogNode() in catalog.c, to prevent redundant exponential traversal of catalog chains. Guard the new loop against a NULL entry so a nextCatalog element without a 'catalog' attribute is still skipped with an error instead of crashing - CVE-2026-0992 Moderate TuxCare License Agreement CVE-2026-0990 CVE-2026-0992 CVE-2026-0989 CVE-2025-8732 Debian 10 * Non-maintainer upload by the TuxCare ELS team. * CVE-2026-40261: Prevent a command injection vulnerability in Perforce::syncCodeBase(), which appended the source reference to the 'p4 sync -f' command without escaping. Package metadata served by a malicious or compromised Composer repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. - debian/patches/0018-CVE-2026-40261.patch * CVE-2026-40176: Prevent a command injection vulnerability in Perforce::generateP4Command(), which interpolated the Perforce connection parameters (user, client, port) into the 'p4' command line without escaping. A malicious composer.json declaring a Perforce VCS repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. Also backport the prerequisite upstream fix for Perforce::connectClient(), which passed the client spec path through the shell redirection of the same command line with only spaces escaped. - debian/patches/0019-CVE-2026-40176.patch Important TuxCare License Agreement CVE-2026-40261 CVE-2026-40176 Debian 10 * SECURITY UPDATE: a resolver performing DNSSEC validation could consume excessive CPU on a maliciously crafted zone (unbounded NSEC3 iterations when validating referrals to unsigned delegations) - debian/patches/CVE-2026-1519.patch: a resolver performing DNSSEC validation could consume excessive CPU on a maliciously crafted zone (unbounded NSEC3 iterations when validating referrals to unsigned delegations) - CVE-2026-1519 * Build the lib/dns "gen" host tool with large-file support to fix an armel FTBFS: "gen" scans the rdata directories with a non-LFS readdir(), which aborts with EOVERFLOW on 64-bit inodes/offsets on 32-bit architectures. next_file() in lib/dns/gen-unix.h treats the resulting NULL as end-of-directory, so the scan was silently truncated and "gen" emitted an incomplete include/dns/rdatastruct.h. - debian/patches/gen-build-largefile-source.patch Important TuxCare License Agreement CVE-2026-1519 Debian 10 * SECURITY UPDATE: Single-byte buffer overflow in SOCKSv4a connect messages (SOCKS4_CONN_MSG_LEN did not account for the trailing NUL in gio/gsocks4aproxy.c) - debian/patches/CVE-2024-52533.patch: Single-byte buffer overflow in SOCKSv4a connect messages (SOCKS4_CONN_MSG_LEN did not account for the trailing NUL in gio/gsocks4aproxy.c) - CVE-2024-52533 * SECURITY UPDATE: Heap buffer overflow via integer overflow in the escaped-length calculation in g_escape_uri_string() in glib/gconvert.c - debian/patches/CVE-2025-13601.patch: Heap buffer overflow via integer overflow in the escaped-length calculation in g_escape_uri_string() in glib/gconvert.c - CVE-2025-13601 Important TuxCare License Agreement CVE-2026-58010 CVE-2026-58012 CVE-2025-13601 CVE-2026-58013 CVE-2026-58011 CVE-2024-52533 Debian 10 * SECURITY UPDATE: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH - debian/patches/all/git-CVE-2025-4802-elf-Ignore-LD_LIBRARY_PATH-and-debug-env-var-for-setu.patch: elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static - CVE-2025-4802 Important TuxCare License Agreement CVE-2025-4802 Debian 10 * SECURITY UPDATE: integer overflow in the TIM reader leading to an out-of-bounds read on 32-bit systems - debian/patches/CVE-2025-66628.patch: compute image_size through HeapOverflowSanityCheckGetSize() and reject a size larger than the blob in ReadTIMImage() in coders/tim.c - CVE-2025-66628 * SECURITY UPDATE: infinite loop in the PCD decoder when the file has no valid Sync marker - debian/patches/CVE-2026-24485.patch: check the ReadBlob() return value in the PCDGetBits() macro and break out of the Sync-marker search on a short read in DecodeImage() in coders/pcd.c - CVE-2026-24485 * SECURITY UPDATE: stack buffer overflow when parsing an over-long morphology kernel specification - debian/patches/CVE-2026-28494.patch: clamp the geometry substring length to sizeof(token)-1 in ParseKernelArray() and ParseKernelName() in magick/morphology.c - CVE-2026-28494 * SECURITY UPDATE: uninitialized pointer dereference in the JBIG decoder on a truncated or corrupt stream - debian/patches/CVE-2026-28691.patch: throw a corrupt image exception when the decode loop does not finish with JBG_EOK in ReadJBIGImage() in coders/jbig.c - CVE-2026-28691 * SECURITY UPDATE: integer overflow in the DIB coder leading to an out-of-bounds read or write - debian/patches/CVE-2026-28693.patch: compute bytes_per_line and length through HeapOverflowSanityCheckGetSize() and make the blob-size check overflow-free in ReadDIBImage() and WriteDIBImage() in coders/dib.c - CVE-2026-28693 Important TuxCare License Agreement CVE-2026-24485 CVE-2026-61866 CVE-2026-28691 CVE-2025-66628 CVE-2026-28494 CVE-2026-28693 Debian 10 * SECURITY UPDATE: fix ASN.1 decoder length truncation causing heap buffer over-read (tasn_dec.c) - debian/patches/CVE-2026-34180.patch: fix ASN.1 decoder length truncation causing heap buffer over-read (tasn_dec.c) - CVE-2026-34180 * SECURITY UPDATE: NULL check pwri->keyDerivationAlgorithm in cms_RecipientInfo_pwri_crypt() (cms_pwri.c) - debian/patches/CVE-2026-42766.patch: NULL check pwri->keyDerivationAlgorithm in cms_RecipientInfo_pwri_crypt() (cms_pwri.c) - CVE-2026-42766 Important TuxCare License Agreement CVE-2026-34180 CVE-2026-42766 Debian 10 * SECURITY UPDATE: Reject substituting extension schemas containing quoting-relevant characters, preventing SQL injection via @extschema@ in extension scripts - debian/patches/CVE-2023-39417.patch: Reject substituting extension schemas containing quoting-relevant characters, preventing SQL injection via @extschema@ in extension scripts - CVE-2023-39417 * SECURITY UPDATE: Detect integer overflow while computing new array dimensions in array_set_element(), array_set_element_expanded() and array_set_slice() - debian/patches/CVE-2023-5869.patch: Detect integer overflow while computing new array dimensions in array_set_element(), array_set_element_expanded() and array_set_slice() - CVE-2023-5869 * SECURITY UPDATE: Run REFRESH MATERIALIZED VIEW CONCURRENTLY in the right security context when creating the temporary diff table - debian/patches/CVE-2024-0985.patch: Run REFRESH MATERIALIZED VIEW CONCURRENTLY in the right security context when creating the temporary diff table - CVE-2024-0985 Important TuxCare License Agreement CVE-2023-5869 CVE-2024-0985 CVE-2023-39417 Debian 10 * SECURITY UPDATE: assertion failure in nghttp2 HTTP/2 frame processing - debian/patches/CVE-2026-27135-1.patch: add missing iframe->state validations in nghttp2_session_mem_recv so that reception stops once the session has been terminated, avoiding an assertion failure on a subsequent malformed frame - debian/patches/CVE-2026-27135-2.patch: add the same validation after session_after_header_block_received and after session_process_data_frame, which upstream carries since 1.67.0 and which the fix above therefore does not touch - CVE-2026-27135 Important TuxCare License Agreement CVE-2026-27135 Debian 10 * SECURITY UPDATE: named running as a recursive resolver could be driven to exceed the configured max-cache-size, and exhaust available memory, because tree-pruning cleanup events were queued faster than they were processed - debian/patches/CVE-2023-6516.patch: limit isc_task_send() overhead for tree pruning (upstream c3377cbfaa) - debian/patches/CVE-2023-6516-lock-contention.patch: reduce lock contention during RBTDB tree pruning (upstream 801e888d03) - debian/patches/CVE-2023-6516-prune-guards.patch: guard re-queueing a node for pruning (upstream f6289ad931, 4b6fc97af6, 7d9be24bb1) - debian/patches/CVE-2023-6516-final-design.patch: the pruning design upstream settled on in 9.16.49, GL #4621 (upstream a548312191, eba7fb5f9f, 5f98eba608); adds dns_db_setprunetask() rather than changing the dns_db_settask() ABI - debian/libdns1104.symbols: record the three entry points the last patch adds - CVE-2023-6516 Important TuxCare License Agreement CVE-2023-6516 Debian 10 * CVE-2026-29111: validate the GetUnitByControlGroup cgroup path - debian/patches/CVE-2026-29111.patch: an unprivileged D-Bus caller could hand PID 1 a cgroup path that is neither absolute nor normalized via the GetUnitByControlGroup method, which on v249 and older overwrites stack memory with attacker-controlled content. Validate with path_is_absolute() and path_is_normalized() before manager_get_unit_by_cgroup(). * test: skip the meson suite on armel - debian/rules: the debian10-els armel worker runs under qemu-user (TCG) rather than native ARM hardware, so nine tests abort and two time out on interfaces qemu does not emulate (raw clone(), PR_SET_MM_ARG_*, SO_ATTACH_FILTER, netlink, netns, SIGBUS), and test-capability crashes the emulator itself. None of it is reachable from the package source. The full suite still runs on amd64 and arm64. * test: fix two test failures on the current build nodes - debian/patches/test-seccomp-accept-ENOSYS-from-sysctl-2-too.patch: _sysctl(2) was removed from the kernel and now fails with ENOSYS rather than EFAULT, so test_protect_sysctl() aborted (upstream commit 0af05e485a3a). - debian/patches/fs-util-do-not-chmod-symlinks-in-touch_file.patch: touch_file() chmod()ed symlinks through /proc/self/fd, which newer kernels reject, so test_touch_file() aborted. Skip the chmod() for symlinks as upstream does in fchmod_and_chown(), and drop the now meaningless mode assertion from the test. Important TuxCare License Agreement CVE-2026-29111 Debian 10 * SECURITY UPDATE: configuration injection in configparser via a carriage return in an attacker-controlled written value - debian/patches/CVE-2026-0864.patch: in Lib/configparser.py, normalize CR and CRLF to LF before indenting continuation lines in RawConfigParser._write_section(), so a bare carriage return inside a written value can no longer round-trip into an unindented line that the parser reads back as a separate "key = value" pair. Backport of upstream commit 5858e42c539d (gh-143927 / GH-143929) via the 3.10 backport 12dcbd74d356; applies to 3.7.3 with line offsets only. Bundles the upstream regression test test_crlf_normalization (test_configparser.py). - CVE-2026-0864 Important TuxCare License Agreement CVE-2026-0864 Debian 10 * SECURITY UPDATE: double free in sftp_open() lets a malicious SSH server corrupt the heap of an authenticated client opening an SFTP session - debian/patches/CVE-2026-66032.patch: set data to NULL after freeing the SSH_FXP_STATUS response buffer on the FX_OK path, so the if(badness) arm cannot free the same pointer a second time when the follow-up sftp_packet_require() for SSH_FXP_HANDLE fails, in sftp_open() in src/sftp.c - CVE-2026-66032 Important TuxCare License Agreement CVE-2026-66032 Debian 10 * SECURITY UPDATE: use-after-free in the ssh client when a remote forwarding is added over the multiplexing socket - debian/patches/CVE-2026-73282.patch: pass a heap-allocated index instead of a pointer into options.remote_forwards[] to ssh_confirm_remote_forward() in ssh.c, so a concurrent add_remote_forward() reallocation cannot leave the pending global request confirmation holding a dangling pointer. - CVE-2026-73282 * SECURITY UPDATE: authorized_keys restrict keyword did not cover tunnel forwarding - debian/patches/CVE-2026-73283.patch: also reject tunnel device forwarding in server_request_tun() (serverloop.c) when the authenticating key carries the restrict option. - CVE-2026-73283 Important TuxCare License Agreement CVE-2026-73282 CVE-2026-73283 Debian 10 * Bump kernel ABI to 28: ship the ELS kernel as linux-image-4.19.0-28-*, distinct from Debian stock 4.19.0-27. * Backport security fixes for CVE-2026-31431 (af_alg / AEAD): - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: algif_aead - Fix minimum RX size check for decryption * Backport security fixes for CVE-2026-53043 (ocfs2/dlm out-of-bounds): - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.317 - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64 - wifi: iwlwifi: mvm: don't read past the mfuart notifcation - ipv6: sr: block BH in seg6_output_core() and seg6_input_core() - vxlan: Fix regression when dropping packets due to invalid src addresses - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB - ptp: Fix error message on failed pin verification - af_unix: Annotate data-race of sk->sk_state in unix_inq_len(). - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll(). - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg(). - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG. - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen. - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect(). - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen(). - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill(). - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete - drm/amd/display: Handle Y carry-over in VCP X.Y calculation - serial: sc16is7xx: replace hardcoded divisor value with BIT() macro - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler - media: mc: mark the media devnode as registered from the, start - selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages - selftests/mm: conform test to TAP format output - selftests/mm: compaction_test: fix bogus test success on Aarch64 - nilfs2: Remove check for PageError - nilfs2: return the mapped address from nilfs_get_page() - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages - mei: me: release irq in mei_me_pci_resume error path - jfs: xattr: fix buffer overflow for invalid xattr - xhci: Apply reset resume quirk to Etron EJ188 xHCI host - xhci: Apply broken streams quirk to Etron EJ188 xHCI host - Input: try trimming too long modalias strings - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING - HID: core: remove unnecessary WARN_ON() in implement() - iommu/amd: Fix sysfs leak in iommu init - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet - drm/bridge/panel: Fix runtime warning on panel bridge release - tcp: fix race in tcp_v6_syn_recv_sock() - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ - ipv6/route: Add a missing check on proc_dointvec - net/ipv6: Fix the RT cache flush via sysctl using a previous delay - drivers: core: synchronize really_probe() and dev_uevent() - drm/exynos/vidi: fix memory leak in .get_modes() - vmci: prevent speculation leaks by sanitizing event in event_deliver() - fs/proc: fix softlockup in __read_vmcore - ocfs2: use coarse time for new created files - ocfs2: fix races between hole punching and AIO+DIO - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id - dmaengine: axi-dmac: fix possible race in remove() - intel_th: pci: Add Granite Rapids support - intel_th: pci: Add Granite Rapids SOC support - intel_th: pci: Add Sapphire Rapids SOC support - intel_th: pci: Add Meteor Lake-S support - intel_th: pci: Add Lunar Lake support - nilfs2: fix potential kernel bug due to lack of writeback flag waiting - hv_utils: drain the timesync packets on onchannelcallback - hugetlb_encode.h: fix undefined behaviour (34 << 26) - usb-storage: alauda: Check whether the media is initialized - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment - batman-adv: bypass empty buckets in batadv_purge_orig_ref() - scsi: qedi: Fix crash while reading debugfs attribute - powerpc/pseries: Enforce hcall result buffer validity and size - powerpc/io: Avoid clang null pointer arithmetic warnings - usb: misc: uss720: check for incompatible versions of the Belkin F5U002 - udf: udftime: prevent overflow in udf_disk_stamp_to_time() - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports - MIPS: Octeon: Add PCIe link status check - MIPS: Routerboard 532: Fix vendor retry check code - cipso: fix total option length computation - netrom: Fix a memory leak in nr_heartbeat_expiry() - ipv6: prevent possible NULL dereference in rt6_probe() - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() - virtio_net: checksum offloading handling fix - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings - regulator: core: Fix modpost error "regulator_get_regmap" undefined - dmaengine: ioatdma: Fix missing kmem_cache_destroy() - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." - drm/radeon: fix UBSAN warning in kv_dpm.c - gcov: add support for GCC 14 - ARM: dts: samsung: smdkv310: fix keypad no-autorepeat - ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat - ARM: dts: samsung: smdk4412: fix keypad no-autorepeat - selftests/ftrace: Fix checkbashisms errors - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test - perf/core: Fix missing wakeup when waiting for context reference - PCI: Add PCI_ERROR_RESPONSE and related definitions - x86/amd_nb: Check for invalid SMN reads - iio: dac: ad5592r-base: Replace indio_dev->mlock with own device lock - iio: dac: ad5592r: un-indent code-block for scale read - iio: dac: ad5592r: fix temperature channel scaling value - scsi: mpt3sas: Add ioc_<level> logging macros - scsi: mpt3sas: Gracefully handle online firmware update - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory - xhci: Use soft retry to recover faster from transaction errors - xhci: Set correct transferred length for cancelled bulk transfers - usb: xhci: do not perform Soft Retry for some xHCI hosts - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set - drm/amdgpu: fix UBSAN warning in kv_dpm.c - netfilter: nf_tables: validate family when identifying table via handle - ASoC: fsl-asoc-card: set priv->pdev before using it - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep - net/iucv: Avoid explicit cpumask var allocation on stack - ALSA: emux: improve patch ioctl data validation - media: dvbdev: Initialize sbuf - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message - nvme: fixup comment for nvme RDMA Provider Type - gpio: davinci: Validate the obtained number of IRQs - i2c: ocores: stop transfer on timeout - i2c: ocores: set IACK bit after core is enabled - x86: stop playing stack games in profile_pc() - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos - iio: adc: ad7266: Fix variable checking bug - iio: chemical: bme680: Fix pressure value output - iio: chemical: bme680: Fix calibration data variable - iio: chemical: bme680: Fix overflows in compensate() functions - iio: chemical: bme680: Fix sensor data read operation - net: usb: ax88179_178a: improve link status logs - usb: gadget: printer: SS+ support - usb: musb: da8xx: fix a resource leak in probe() - usb: atm: cxacru: fix endpoint checking in cxacru_bind() - tty: mcf: MCF54418 has 10 UARTS - hexagon: fix fadvise64_64 calling conventions - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes - batman-adv: Don't accept TT entries for out-of-spec VIDs - ata: libata-core: Fix double free on error - ftruncate: pass a signed offset - pwm: stm32: Refuse too small period requests - ipv6: annotate some data-races around sk->sk_prot - ipv6: Fix data races around sk->sk_prot. - tcp: Fix data races around icsk->icsk_af_ops. - arm64: dts: rockchip: Add sound-dai-cells for RK3368 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.318 - asm-generic: Move common compat types to asm-generic/compat.h - media: dvb: as102-fe: Fix as10x_register_addr packing - media: dvb-usb: dib0700_devices: Add missing release_firmware() - IB/core: Implement a limit on UMAD receive List - drm/amd/display: Skip finding free audio for unknown engine_id - media: dw2102: Don't translate i2c read into write - sctp: prefer struct_size over open coded arithmetic - firmware: dmi: Stop decoding on broken entry - Input: ff-core - prefer struct_size over open coded arithmetic - net: dsa: mv88e6xxx: Correct check for empty list - media: dvb-frontends: tda18271c2dd: Remove casting during div - media: s2255: Use refcount_t instead of atomic_t for num_channels - media: dvb-frontends: tda10048: Fix integer overflow - i2c: i801: Annotate apanel_addr as __ro_after_init - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n - orangefs: fix out-of-bounds fsid access - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#" - jffs2: Fix potential illegal address access in jffs2_free_inode - s390/pkey: Wipe sensitive data on failure - tcp: take care of compressed acks in tcp_add_reno_sack() - tcp: tcp_mark_head_lost is only valid for sack-tcp - tcp: add ece_ack flag to reno sack functions - net: tcp better handling of reordering then loss cases - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open() - tcp_metrics: validate source addr length - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() - selftests: fix OOM in msg_zerocopy selftest - selftests: make order checking verbose in msg_zerocopy selftest - inet_diag: Initialize pad field in struct inet_diag_req_v2 - nilfs2: fix inode number range checks - nilfs2: add missing check for inode numbers on directory entries - mm: optimize the redundant loop of mm_update_owner_next() - Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct - fsnotify: Do not generate events for O_PATH file descriptors - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes - drm/amdgpu/atomfirmware: silence UBSAN warning - bnx2x: Fix multiple UBSAN array-index-out-of-bounds - media: dw2102: fix a potential buffer overflow - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr - nilfs2: fix incorrect inode allocation from reserved inodes - drm/i915: make find_fw_domain work on intel_uncore - tcp: fix incorrect undo caused by DSACK of TLP retransmit - net: lantiq_etop: add blank line after declaration - net: ethernet: lantiq_etop: fix double free in detach - ppp: reject claimed-as-LCP but actually malformed packets - ARM: davinci: Convert comma to semicolon - USB: serial: option: add Telit generic core-dump composition - USB: serial: option: add Telit FN912 rmnet compositions - USB: serial: option: add Fibocom FM350-GL - USB: serial: option: add support for Foxconn T99W651 - USB: serial: option: add Netprisma LCUK54 series modules - USB: serial: option: add Rolling RW350-GL variants - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor - hpet: Support 32-bit userspace - libceph: fix race between delayed_work() and ceph_monc_stop() - tcp: refactor tcp_retransmit_timer() - net: tcp: fix unexcepted socket die when snd_wnd is 0 - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() - tcp: avoid too many retransmit packets - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries - nilfs2: fix kernel bug on rename operation of broken directory - i2c: rcar: bring hardware to known state when probing https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.319 - gcc-plugins: Rename last_stmt() for GCC 14+ - scsi: qedf: Set qed_slowpath_params to zero before use - ACPI: EC: Abort address space access upon error - ACPI: EC: Avoid returning AE_OK on errors in address space handler - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() - Input: silead - Always support 10 fingers - ila: block BH in ila_output() - kconfig: gconf: give a proper initial state to the Save button - kconfig: remove wrong expr_trans_bool() - fs/file: fix the check in find_next_fd() - mei: demote client disconnect warning on suspend to debug - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check - Input: elantech - fix touchpad state on resume for Lenovo N24 - bytcr_rt5640 : inverse jack detect for Archos 101 cesium - can: kvaser_usb: fix return value for hif_usb_send_regout - s390/sclp: Fix sclp_init() cleanup on failure - ALSA: dmaengine_pcm: terminate dmaengine before synchronize - net: usb: qmi_wwan: add Telit FN912 compositions - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD() - Bluetooth: hci_core: cancel all works upon hci_unregister_dev() - fs: better handle deep ancestor chains in is_subdir() - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices - selftests/vDSO: fix clang build errors and warnings - hfsplus: fix uninit-value in copy_name - filelock: Remove locks reliably when fcntl/close race is detected - ARM: 9324/1: fix get_user() broken with veneer - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency - net: relax socket state check at accept time. - ocfs2: add bounds checking to ocfs2_check_dir_entry() - jfs: don't walk off the end of ealist - filelock: Fix fcntl/close race recovery compat path https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.320 - platform/chrome: cros_ec_debugfs: fix wrong EC message version - hfsplus: fix to avoid false alarm of circular locking - x86/of: Return consistent error type from x86_of_pci_irq_enable() - x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling - x86/pci/xen: Fix PCIBIOS_* return code handling - x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos - hwmon: (adt7475) Fix default duty on fan is disabled - pwm: stm32: Always do lazy disabling - hwmon: (max6697) Fix underflow when writing limit attributes - hwmon: Introduce SENSOR_DEVICE_ATTR_{RO, RW, WO} and variants - hwmon: (max6697) Auto-convert to use SENSOR_DEVICE_ATTR_{RO, RW, WO} - hwmon: (max6697) Fix swapped temp{1,8} critical alarms - arm64: dts: rockchip: Increase VOP clk rate on RK3328 - m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages - x86/xen: Convert comma to semicolon - m68k: cmpxchg: Fix return value for default case in __arch_xchg() - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device - net/smc: Allow SMC-D 1MB DMB allocations - net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined - selftests/bpf: Check length of recv in test_sockmap - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() - net: fec: Refactor: #define magic constants - net: fec: Fix FEC_ECR_EN1588 being cleared on link-down - ipvs: Avoid unnecessary calls to skb_is_gso_sctp - perf: Fix perf_aux_size() for greater-than 32-bit size - perf: Prevent passing zero nr_pages to rb_alloc_aux() - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures - selftests: forwarding: devlink_lib: Wait for udev events after reloading - media: imon: Fix race getting ictx->lock - saa7134: Unchecked i2c_transfer function result fixed - media: uvcvideo: Allow entity-defined get_info and get_cur - media: uvcvideo: Override default flags - media: renesas: vsp1: Fix _irqsave and _irq mix - media: renesas: vsp1: Store RPF partition configuration per RPF instance - leds: trigger: Unregister sysfs attributes before calling deactivate() - perf report: Fix condition in sort__sym_cmp() - drm/etnaviv: fix DMA direction handling for cached RW buffers - mfd: omap-usb-tll: Use struct_size to allocate tll - ext4: avoid writing unitialized memory to disk in EA inodes - sparc64: Fix incorrect function signature and add prototype for prom_cif_init - PCI: Equalize hotplug memory and io for occupied and empty slots - PCI: Fix resource double counting on remove & rescan - RDMA/mlx4: Fix truncated output warning in mad.c - RDMA/mlx4: Fix truncated output warning in alias_GUID.c - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs - mtd: make mtd_test.c a separate module - Input: elan_i2c - do not leave interrupt disabled on suspend failure - MIPS: Octeron: remove source file executable bit - powerpc/xmon: Fix disassembly CPU feature checks - macintosh/therm_windtunnel: fix module unload. - bnxt_re: Fix imm_data endianness - ice: Rework flex descriptor programming - netfilter: ctnetlink: use helper function to calculate expect ID - pinctrl: core: fix possible memory leak when pinctrl_enable() fails - pinctrl: single: fix possible memory leak when pinctrl_enable() fails - pinctrl: ti: ti-iodelay: Drop if block with always false condition - pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails - pinctrl: freescale: mxs: Fix refcount of child - fs/nilfs2: remove some unused macros to tame gcc - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro - tick/broadcast: Make takeover of broadcast hrtimer reliable - net: netconsole: Disable target before netpoll cleanup - af_packet: Handle outgoing VLAN packets without hardware offloading - ipv6: take care of scope when choosing the src addr - char: tpm: Fix possible memory leak in tpm_bios_measurements_open() - media: venus: fix use after free in vdec_close - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes - m68k: amiga: Turn off Warp1260 interrupts during boot - ext4: check dot and dotdot of dx_root before making dir indexed - ext4: make sure the first directory block is not a hole - wifi: mwifiex: Fix interface type change - leds: ss4200: Convert PCIBIOS_* return codes to errnos - tools/memory-model: Fix bug in lock.cat - hwrng: amd - Convert PCIBIOS_* return codes to errnos - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN - binder: fix hang of unregistered readers - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds - f2fs: fix to don't dirty inode for readonly filesystem - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use - ubi: eba: properly rollback inside self_check_eba - decompress_bunzip2: fix rare decompression failure - kobject_uevent: Fix OOB access within zap_modalias_env() - rtc: cmos: Fix return value of nvmem callbacks - scsi: qla2xxx: During vport delete send async logout explicitly - scsi: qla2xxx: validate nvme_local_port correctly - perf/x86/intel/pt: Fix topa_entry base length - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter - platform: mips: cpu_hwmon: Disable driver on unsupported hardware - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs - selftests/sigaltstack: Fix ppc64 GCC build - nilfs2: handle inconsistent state in nilfs_btnode_create_block() - kdb: Fix bound check compiler warning - kdb: address -Wformat-security warnings - kdb: Use the passed prompt in kdb_position_cursor() - jfs: Fix array-index-out-of-bounds in diFree - dma: fix call order in dmam_free_coherent - MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later - net: ip_rt_get_source() - use new style struct initializer instead of memset - ipv4: Fix incorrect source address in Record Route option - net: bonding: correctly annotate RCU in bond_should_notify_peers() - tipc: Return non-zero value from tipc_udp_addr2str() on error - mISDN: Fix a use after free in hfcmulti_tx() - mm: avoid overflows in dirty throttling logic - PCI: rockchip: Make 'ep-gpios' DT property optional - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio - parport: parport_pc: Mark expected switch fall-through - parport: Convert printk(KERN_<LEVEL> to pr_<level>( - parport: Standardize use of printmode - dev/parport: fix the array out-of-bounds risk - driver core: Cast to (void *) with __force for __percpu pointer - devres: Fix memory leakage caused by driver API devm_free_percpu() - perf/x86/intel/pt: Export pt_cap_get() - perf/x86/intel/pt: Use helpers to obtain ToPA entry size - perf/x86/intel/pt: Use pointer arithmetics instead in ToPA entry calculation - perf/x86/intel/pt: Split ToPA metadata and page layout - perf/x86/intel/pt: Fix a topa_entry base address calculation - remoteproc: imx_rproc: ignore mapping vdev regions - remoteproc: imx_rproc: Fix ignoring mapping vdev regions - remoteproc: imx_rproc: Skip over memory region when node value is NULL - drm/vmwgfx: Fix overlay when using Screen Targets - net/iucv: fix use after free in iucv_sock_close() - ipv6: fix ndisc_is_useropt() handling for PIO - protect the fetch of ->fd[fd] in do_dup2() from mispredictions - ALSA: usb-audio: Correct surround channels in UAC1 channel map - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read - irqchip/mbigen: Fix mbigen node address layout - x86/mm: Fix pti_clone_pgtable() alignment assumption - net: usb: qmi_wwan: fix memory leak for not ip packets - net: linkwatch: use system_unbound_wq - Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() - net: fec: Stop PPS on driver remove - md/raid5: avoid BUG_ON() while continue reshape after reassembling - clocksource/drivers/sh_cmt: Address race condition for clock events - PCI: Add Edimax Vendor ID to pci_ids.h - udf: prevent integer overflow in udf_bitmap_free_blocks() - wifi: nl80211: don't give key data to userspace - btrfs: fix bitmap leak when loading free space cache on duplicate entry - media: uvcvideo: Ignore empty TS packets - media: uvcvideo: Fix the bandwdith quirk on USB 3.x - jbd2: avoid memleak in jbd2_journal_write_metadata_buffer - s390/sclp: Prevent release of buffer in I/O - SUNRPC: Fix a race to wake a sync task - ext4: fix wrong unit use in ext4_mb_find_by_goal - arm64: Add support for SB barrier and patch in over DSB; ISB sequences - arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space - arm64: Add Neoverse-V2 part - arm64: cputype: Add Cortex-X4 definitions - arm64: cputype: Add Neoverse-V3 definitions - arm64: errata: Add workaround for Arm errata 3194386 and 3312417 - arm64: cputype: Add Cortex-X3 definitions - arm64: cputype: Add Cortex-A720 definitions - arm64: cputype: Add Cortex-X925 definitions - arm64: errata: Unify speculative SSBS errata logic - arm64: errata: Expand speculative SSBS workaround - arm64: cputype: Add Cortex-X1C definitions - arm64: cputype: Add Cortex-A725 definitions - arm64: errata: Expand speculative SSBS workaround (again) - i2c: smbus: Don't filter out duplicate alerts - i2c: smbus: Improve handling of stuck alerts - i2c: smbus: Send alert notifications to all devices if source not found - bpf: kprobe: remove unused declaring of bpf_kprobe_override - spi: lpspi: Replace all "master" with "controller" - spi: lpspi: Add slave mode support - spi: lpspi: Let watermark change with send data length - spi: lpspi: Add i.MX8 boards support for lpspi - spi: lpspi: add the error info of transfer speed setting - spi: fsl-lpspi: remove unneeded array - spi: spi-fsl-lpspi: Fix scldiv calculation - ALSA: line6: Fix racy access to midibuf - usb: vhci-hcd: Do not drop references before new references are gained - USB: serial: debug: do not echo input by default - usb: gadget: core: Check for unset descriptor - scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic - tick/broadcast: Move per CPU pointer access into the atomic section - ntp: Clamp maxerror and esterror to operating range - driver core: Fix uevent_show() vs driver detach race - ntp: Safeguard against time_constant overflow - serial: core: check uartclk for zero to avoid divide by zero - power: supply: axp288_charger: Fix constant_charge_voltage writes - power: supply: axp288_charger: Round constant_charge_voltage writes down - tracing: Fix overflow in get_free_elt() - x86/mtrr: Check if fixed MTRRs exist before saving them - drm/bridge: analogix_dp: properly handle zero sized AUX transactions - drm/mgag200: Set DDC timeout in milliseconds - kbuild: Fix '-S -c' in x86 stack protector scripts - netfilter: nf_tables: set element extended ACK reporting support - netfilter: nf_tables: use timestamp to check for set element timeout - netfilter: nf_tables: prefer nft_chain_validate - arm64: cpufeature: Fix the visibility of compat hwcaps - media: uvcvideo: Use entity get_cur in uvc_ctrl_set - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation - exec: Fix ToCToU between perm check and set-uid/gid usage - nvme/pci: Add APST quirk for Lenovo N60z laptop https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.321 - fuse: Initialize beyond-EOF page contents before setting uptodate - ALSA: usb-audio: Support Yamaha P-125 quirk entry - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE - dm resume: don't return EINVAL when signalled - dm persistent data: fix memory allocation failure - bitmap: introduce generic optimized bitmap_size() - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE - selinux: fix potential counting error in avc_add_xperms_decision() - drm/amdgpu: Actually check flags for all context ops. - memcg_write_event_control(): fix a user-triggerable oops - s390/cio: rename bitmap_size() -> idset_bitmap_size() - overflow.h: Add flex_array_size() helper - overflow: Implement size_t saturating arithmetic helpers - btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() - net/mlx5e: Correctly report errors for ethtool rx flows - atm: idt77252: prevent use after free in dequeue_rx() - net: dsa: vsc73xx: pass value in phy_write operation - ssb: Fix division by zero issue in ssb_calc_clock_rate - wifi: cw1200: Avoid processing an invalid TIM IE - i2c: riic: avoid potential division by zero - staging: ks7010: disable bh on tx_dev_lock - binfmt_misc: cleanup on filesystem umount - scsi: spi: Fix sshdr use - gfs2: setattr_chown: Add missing initialization - wifi: iwlwifi: abort scan when rfkill on but device enabled - powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu - ext4: do not trim the group with corrupted block bitmap - quota: Remove BUG_ON from dqget() - media: pci: cx23885: check cx23885_vdev_init() return - fs: binfmt_elf_efpic: don't use missing interpreter's properties - scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() - net/sun3_82586: Avoid reading past buffer in debug output - md: clean up invalid BUG_ON in md_ioctl - parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 - powerpc/boot: Handle allocation failure in simple_realloc() - powerpc/boot: Only free if realloc() succeeds - btrfs: change BUG_ON to assertion when checking for delayed_node root - btrfs: handle invalid root reference found in may_destroy_subvol() - btrfs: send: handle unexpected data in header buffer in begin_cmd() - btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() - f2fs: fix to do sanity check in update_sit_entry - usb: gadget: fsl: Increase size of name buffer for endpoints - Bluetooth: bnep: Fix out-of-bound access - NFS: avoid infinite loop in pnfs_update_layout. - openrisc: Call setup_memory() earlier in the init sequence - s390/iucv: fix receive buffer virtual vs physical address confusion - usb: dwc3: core: Skip setting event buffers for host only controllers - irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc - ext4: set the type of max_zeroout to unsigned int to avoid overflow - nvmet-rdma: fix possible bad dereference when freeing rsps - hrtimer: Prevent queuing of hrtimer without a function callback - gtp: pull network headers in gtp_dev_xmit() - block: use "unsigned long" for blk_validate_block_size(). - Bluetooth: Make use of __check_timeout on hci_sched_le - Bluetooth: hci_core: Fix not handling link timeouts propertly - Bluetooth: hci_core: Fix LE quote calculation - kcm: Serialise kcm_sendmsg() for the same socket. - netfilter: nft_counter: Synchronize nft_counter_reset() against reader. - ipv6: prevent UAF in ip6_send_skb() - net: xilinx: axienet: Always disable promiscuous mode - drm/msm: use drm_debug_enabled() to check for debug categories - drm/msm/dpu: don't play tricks with debug macros - mmc: mmc_test: Fix NULL dereference on allocation failure - Bluetooth: MGMT: Add error handling to pair_device() - HID: wacom: Defer calculation of resolution until resolution_code is known - cxgb4: add forgotten u64 ivlan cast before shift - mmc: dw_mmc: allow biu and ciu clocks to defer - ALSA: timer: Relax start tick time check for slave timer elements - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO - Input: MT - limit max slots - tools: move alignment-related macros to new <linux/align.h> - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc - pinctrl: single: fix potential NULL dereference in pcs_get_function() - wifi: mwifiex: duplicate static structs used in driver instances - dm suspend: return -ERESTARTSYS instead of -EINTR - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES - filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 - media: uvcvideo: Fix integer overflow calculating timestamp - ata: libata-core: Fix null pointer dereference on error - cgroup/cpuset: Prevent UAF in proc_cpuset_show() - memcg: enable accounting of ipc resources - fbcon: Prevent that screen size is smaller than font size - fbmem: Check virtual screen sizes in fb_set_var() - net:rds: Fix possible deadlock in rds_message_put - ida: Fix crash in ida_free when the bitmap is empty - net: prevent mss overflow in skb_segment() - soundwire: stream: fix programming slave ports for non-continous port maps - gtp: fix a potential NULL pointer dereference - net: busy-poll: use ktime_get_ns() instead of local_clock() - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller - USB: serial: option: add MeiG Smart SRM825L - usb: dwc3: omap: add missing depopulate in probe error path - usb: dwc3: core: Prevent USB core invalid event buffer address access - usb: dwc3: st: fix probed platform device ref count on probe error path - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() - scsi: aacraid: Fix double-free on probe failure - ipc: remove memcg accounting for sops objects in do_semtimedop() - drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.322 - net: usb: qmi_wwan: add MeiG Smart SRM825L - usb: dwc3: st: Add of_node_put() before return in probe function - usb: dwc3: st: add missing depopulate in probe error path - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr - drm/amdgpu: fix overflowed array index read warning - drm/amdgpu: fix ucode out-of-bounds read warning - drm/amdgpu: fix mc_data out-of-bounds read warning - drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device - apparmor: fix possible NULL pointer dereference - usbip: Don't submit special requests twice - smack: tcp: ipv4, fix incorrect labeling - media: uvcvideo: Enforce alignment of frame and interval - block: initialize integrity buffer to zero before writing it to media - virtio_net: Fix napi_skb_cache_put warning - udf: Limit file size to 4TB - ALSA: usb-audio: Sanity checks for each pipe and EP types - ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check - sch/netem: fix use after free in netem_dequeue - ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices - ata: libata: Fix memory leak for error path in ata_host_alloc() - mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K - fuse: use unsigned type for getxattr/listxattr size truncation - clk: qcom: clk-alpha-pll: Fix the pll post div mask - nilfs2: fix missing cleanup on rollforward recovery error - nilfs2: fix state management in error path of log writing function - ALSA: hda: Add input value sanity checks to HDMI channel map controls - smack: unix sockets: fix accept()ed socket label - irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 - af_unix: Remove put_pid()/put_cred() in copy_peercred(). - netfilter: nf_conncount: fix wrong variable type - udf: Avoid excessive partition lengths - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 - media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse - pcmcia: Use resource_size function on resource object - can: bcm: Remove proc entry when dev is unregistered. - igb: Fix not clearing TimeSync interrupts for 82580 - platform/x86: dell-smbios: Fix error path in dell_smbios_init() - cx82310_eth: re-enable ethernet mode after router reboot - drivers/net/usb: Remove all strcpy() uses - net: usb: don't write directly to netdev->dev_addr - usbnet: modern method to get random MAC - rfkill: fix spelling mistake contidion to condition - net: bridge: add support for sticky fdb entries - bridge: switchdev: Allow clearing FDB entry offload indication - net: bridge: fdb: convert is_local to bitops - net: bridge: fdb: convert is_static to bitops - net: bridge: fdb: convert is_sticky to bitops - net: bridge: fdb: convert added_by_user to bitops - net: bridge: fdb: convert added_by_external_learn to use bitops - net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN - net: dsa: vsc73xx: fix possible subblocks range of CAPT block - iommu/vt-d: Handle volatile descriptor status read - cgroup: Protect css->cgroup write under css_set_lock - um: line: always fill *error_out in setup_one_line() - devres: Initialize an uninitialized struct member - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv - hwmon: (adc128d818) Fix underflows seen when writing limit attributes - hwmon: (lm95234) Fix underflows seen when writing limit attributes - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() - smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() - btrfs: replace BUG_ON with ASSERT in walk_down_proc() - btrfs: clean up our handling of refs == 0 in snapshot delete - PCI: Add missing bridge lock to pci_bus_lock() - btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup - Input: uinput - reject requests with unreasonable number of slots - usbnet: ipheth: race between ipheth_close and error handling - Squashfs: sanity check symbolic link size - of/irq: Prevent device address out-of-bounds read in interrupt map walk - ata: pata_macio: Use WARN instead of BUG - iio: buffer-dmaengine: fix releasing dma channel on error - iio: fix scale application in iio_convert_raw_to_processed_unlocked - nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind - Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic - VMCI: Fix use-after-free when removing resource in vmci_resource_remove() - clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX - clocksource/drivers/imx-tpm: Fix next event not taking effect sometime - uprobes: Use kzalloc to allocate xol area - ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance() - tracing: Avoid possible softlockup in tracing_iter_reset() - nilfs2: replace snprintf in show functions with sysfs_emit - nilfs2: protect references to superblock parameters exposed in sysfs - netns: add pre_exit method to struct pernet_operations - ila: call nf_unregister_net_hooks() sooner - ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() - ACPI: processor: Fix memory leaks in error paths of processor_add() - drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused - drm/i915/fence: Mark debug_fence_free() with __maybe_unused - rtmutex: Drop rt_mutex::wait_lock before scheduling - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket - cx82310_eth: fix error return code in cx82310_bind() - netns: restore ops before calling ops_exit_list - Revert "parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367" https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.323 - staging: iio: frequency: ad9833: Get frequency value statically - staging: iio: frequency: ad9833: Load clock using clock framework - staging: iio: frequency: ad9834: Validate frequency parameter value - usbnet: ipheth: fix carrier detection in modes 1 and 4 - net: ethernet: use ip_hdrlen() instead of bit shift - net: phy: vitesse: repair vsc73xx autonegotiation - scripts: kconfig: merge_config: config files: add a trailing newline - arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma - net/mlx5: Update the list of the PCI supported devices - net: ftgmac100: Enable TX interrupt to avoid TX timeout - net: dpaa: Pad packets to ETH_ZLEN - soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" - selftests/vm: remove call to ksft_set_plan() - selftests/kcmp: remove call to ksft_set_plan() - ASoC: allow module autoloading for table db1200_pids - pinctrl: at91: make it work with current gpiolib - microblaze: don't treat zero reserved memory regions as error - net: ftgmac100: Ensure tx descriptor updates are visible - wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead - ASoC: tda7419: fix module autoloading - spi: bcm63xx: Enable module autoloading - x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency - ocfs2: add bounds checking to ocfs2_xattr_find_entry() - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() - gpio: prevent potential speculation leaks in gpio_device_get_desc() - USB: serial: pl2303: add device id for Macrosilicon MS3020 - ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() - wifi: ath9k: fix parameter check in ath9k_init_debug() - wifi: ath9k: Remove error checks when creating debugfs entries - netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire - wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() - wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). - Bluetooth: btusb: Fix not handling ZPL/short-transfer - block, bfq: fix possible UAF for bfqq->bic with merge chain - block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() - block, bfq: don't break merge chain in bfq_split_bfqq() - spi: ppc4xx: handle irq_of_parse_and_map() errors - spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ - ARM: versatile: fix OF node leak in CPUs prepare - reset: berlin: fix OF node leak in probe() error path - clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() - hwmon: (max16065) Fix overflows seen when writing limits - mtd: slram: insert break after errors in parsing the map - hwmon: (ntc_thermistor) fix module autoloading - power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense - fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() - drm/stm: Fix an error handling path in stm_drm_platform_probe() - drm/amd: fix typo - drm/amdgpu: Replace one-element array with flexible-array member - drm/amdgpu: properly handle vbios fake edid sizing - drm/radeon: Replace one-element array with flexible-array member - drm/radeon: properly handle vbios fake edid sizing - drm/rockchip: vop: Allow 4096px width scaling - drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets - jfs: fix out-of-bounds in dbNextAG() and diAlloc() - drm/msm/a5xx: properly clear preemption records on resume - drm/msm/a5xx: fix races in preemption evaluation stage - ipmi: docs: don't advertise deprecated sysfs entries - drm/msm: fix %s null argument error - xen: use correct end address of kernel for conflict checking - xen/swiotlb: simplify range_straddles_page_boundary() - xen/swiotlb: add alignment check for dma buffers - selftests/bpf: Fix error compiling test_lru_map.c - xz: cleanup CRC32 edits from 2018 - kthread: add kthread_work tracepoints - kthread: fix task state in kthread worker if being frozen - jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers() - ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard - smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso - ext4: avoid negative min_clusters in find_group_orlov() - ext4: return error on ext4_find_inline_entry - ext4: avoid OOB when system.data xattr changes underneath the filesystem - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() - nilfs2: determine empty node blocks as corrupted - nilfs2: fix potential oob read in nilfs_btree_check_delete() - perf sched timehist: Fix missing free of session in perf_sched__timehist() - perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time - perf time-utils: Fix 32-bit nsec parsing - clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error - PCI: xilinx-nwl: Fix register misspelling - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency - pinctrl: single: fix missing error code in pcs_probe() - clk: ti: dra7-atl: Fix leak of of_nodes - pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function - RDMA/cxgb4: Added NULL check for lookup_atid - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() - nfsd: call cache_put if xdr_reserve_space returns NULL - f2fs: enhance to update i_mode and acl atomically in f2fs_setattr() - f2fs: fix typo - f2fs: fix to update i_ctime in __f2fs_setxattr() - f2fs: remove unneeded check condition in __f2fs_setxattr() - f2fs: reduce expensive checkpoint trigger frequency - coresight: tmc: sg: Do not leak sg_table - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition - tcp: introduce tcp_skb_timestamp_us() helper - tcp: check skb is non-NULL in tcp_rto_delta_us() - net: qrtr: Update packets cloning when broadcasting - netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS - crypto: aead,cipher - zeroize key buffer after use - Remove *.orig pattern from .gitignore - soc: versatile: integrator: fix OF node leak in probe() error path - USB: appledisplay: close race between probe and completion handler - USB: misc: cypress_cy7c63: check for short transfer - firmware_loader: Block path traversal - tty: rp2: Fix reset with non forgiving PCIe host bridges - drbd: Fix atomicity violation in drbd_uuid_set_bm() - drbd: Add NULL check for net_conf to prevent dereference in state validation - ACPI: sysfs: validate return type of _STR method - f2fs: prevent possible int overflow in dir_block_index() - f2fs: avoid potential int overflow in sanity_check_area_boundary() - vfs: fix race between evice_inodes() and find_inode()&iput() - fs: Fix file_set_fowner LSM hook inconsistencies - nfs: fix memory leak in error path of nfs4_do_reclaim - PCI: xilinx-nwl: Use irq_data_get_irq_chip_data() - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler - soc: versatile: realview: fix memory leak during device remove - soc: versatile: realview: fix soc_dev leak during device remove - usb: yurex: Replace snprintf() with the safer scnprintf() variant - USB: misc: yurex: fix race between read and write - pps: remove usage of the deprecated ida_simple_xx() API - pps: add an error check in parport_attach - i2c: aspeed: Update the stop sw state when the bus recovery occurs - i2c: isch: Add missed 'else' - usb: yurex: Fix inconsistent locking bug in yurex_read() - mailbox: rockchip: fix a typo in module autoloading - mailbox: bcm2835: Fix timeout during suspend mode - ceph: remove the incorrect Fw reference check when dirtying pages - netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED - netfilter: nf_tables: prevent nf_skb_duplicated corruption - r8152: Factor out OOB link list waits - net: ethernet: lantiq_etop: fix memory disclosure - net: avoid potential underflow in qdisc_pkt_len_init() with UFO - net: add more sanity checks to qdisc_pkt_len_init() - ipv4: ip_gre: Fix drops of small packets in ipgre_xmit - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start - ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs - ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin - f2fs: Require FMODE_WRITE for atomic write ioctls - wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit - net: hisilicon: hip04: fix OF node leak in probe() - net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() - net: hisilicon: hns_mdio: fix OF node leak in probe() - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails - ACPI: EC: Do not release locks during operation region accesses - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() - tipc: guard against string buffer overrun - net: mvpp2: Increase size of queue_name buffer - ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). - ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family - tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process - ACPICA: iasl: handle empty connection_node - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() - signal: Replace BUG_ON()s - ALSA: asihpi: Fix potential OOB array access - ALSA: hdsp: Break infinite MIDI input flush loop - fbdev: pxafb: Fix possible use after free in pxafb_task() - power: reset: brcmstb: Do not go into infinite loop if reset fails - ata: sata_sil: Rename sil_blacklist to sil_quirks - jfs: UBSAN: shift-out-of-bounds in dbFindBits - jfs: Fix uaf in dbFreeBits - jfs: check if leafidx greater than num leaves per dmap tree - jfs: Fix uninit-value access of new_ea in ea_buffer - drm/amd/display: Check stream before comparing them - drm/amd/display: Fix index out of bounds in degamma hardware format translation - drm/printer: Allow NULL data in devcoredump printer - scsi: aacraid: Rearrange order of struct aac_srb_unit - drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() - of/irq: Refer to actual buffer size in of_irq_parse_one() - ext4: ext4_search_dir should return a proper error - ext4: fix i_data_sem unlock order in ext4_ind_migrate() - spi: s3c64xx: fix timeout counters in flush_fifo - selftests: breakpoints: use remaining time to check if suspend succeed - selftests: vDSO: fix vDSO symbols lookup for powerpc64 - i2c: xiic: Wait for TX empty to avoid missed TX NAKs - spi: bcm63xx: Fix module autoloading - perf/core: Fix small negative period being ignored - parisc: Fix itlb miss handler for 64-bit programs - ALSA: core: add isascii() check to card ID generator - ext4: no need to continue when the number of entries is 1 - ext4: propagate errors from ext4_find_extent() in ext4_insert_range() - ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() - ext4: aovid use-after-free in ext4_ext_insert_extent() - ext4: fix double brelse() the buffer of the extents path - ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() - parisc: Fix 64-bit userspace syscall path - of/irq: Support #msi-cells=<0> in of_msi_get_domain - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error - ocfs2: fix the la space leak when unmounting an ocfs2 volume - ocfs2: fix uninit-value in ocfs2_get_block() - ocfs2: reserve space for inline xattr before attaching reflink tree - ocfs2: cancel dqi_sync_work before freeing oinfo - ocfs2: remove unreasonable unlock in ocfs2_read_blocks - ocfs2: fix null-ptr-deref when journal load failed. - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate - riscv: define ILLEGAL_POINTER_VALUE for 64bit - aoe: fix the potential use-after-free problem in more places - clk: rockchip: fix error for unknown clocks - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags - media: venus: fix use after free bug in venus_remove due to race condition - iio: magnetometer: ak8975: Fix reading for ak099xx sensors - tomoyo: fallback to realpath if symlink's pathname does not exist - Input: adp5589-keys - fix adp5589_gpio_get_value() - btrfs: wait for fixup workers before stopping cleaner kthread during umount - gpio: davinci: fix lazy disable - ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path - ext4: fix slab-use-after-free in ext4_split_extent_at() - ext4: update orig_path in ext4_find_extent() - arm64: Add Cortex-715 CPU part definition - arm64: cputype: Add Neoverse-N3 definitions - arm64: errata: Expand speculative SSBS workaround once more - uprobes: fix kernel info leak via "[uprobes]" vma - nfsd: use ktime_get_seconds() for timestamps - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds - rtc: at91sam9: drop platform_data support - rtc: at91sam9: fix OF node leak in probe() error path - ACPI: battery: Simplify battery hook locking - ACPI: battery: Fix possible crash when unregistering a battery hook - ext4: fix inode tree inconsistency caused by ENOMEM - net: ethernet: cortina: Drop TSO support - tracing: Remove precision vsnprintf() check from print event - drm: Move drm_mode_setcrtc() local re-init to failure path - drm/crtc: fix uninitialized variable use even harder - virtio_console: fix misc probe bugs - Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal - bpf: Check percpu map value size first - s390/facility: Disable compile time optimization for decompressor code - s390/mm: Add cond_resched() to cmm_alloc/free_pages() - ext4: nested locking for xattr inode - s390/cpum_sf: Remove WARN_ON_ONCE statements - ktest.pl: Avoid false positives with grub2 skip regex - clk: bcm: bcm53573: fix OF node leak in init - i2c: i801: Use a different adapter-name for IDF adapters - PCI: Mark Creative Labs EMU20k2 INTx masking as broken - media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() - usb: chipidea: udc: enable suspend interrupt after usb reset - tools/iio: Add memory allocation failure check for trigger_name - driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute - fbdev: sisfb: Fix strbuf array overflow - NFS: Remove print_overflow_msg() - SUNRPC: Fix integer overflow in decode_rc_list() - tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe - netfilter: br_netfilter: fix panic with metadata_dst skb - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change - gpio: aspeed: Add the flush write to ensure the write complete. - clk: Add (devm_)clk_get_optional() functions - clk: generalize devm_clk_get() a bit - clk: Provide new devm_clk helpers for prepared and enabled clocks - gpio: aspeed: Use devm_clk api to manage clock source - igb: Do not bring the device up after non-fatal error - net: ibm: emac: mal: fix wrong goto - ppp: fix ppp_async_encode() illegal access - net: ipv6: ensure we call ipv6_mc_down() at most once - CDC-NCM: avoid overflow in sanity checking - HID: plantronics: Workaround for an unexcepted opposite volume key - Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" - usb: xhci: Fix problem with xhci resume from suspend - usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip - net: Fix an unsafe loop on the list - posix-clock: Fix missing timespec64 check in pc_clock_settime() - arm64: probes: Remove broken LDR (literal) uprobe support - arm64: probes: Fix simulate_ldr*_literal() - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip - fat: fix uninitialized variable - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() - net: dsa: mv88e6xxx: Fix out-of-bound access - s390/sclp_vt220: Convert newlines to CRLF instead of LFCR - KVM: s390: Change virtual to physical address access in diag 0x258 handler - x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET - drm/vmwgfx: Handle surface check failure correctly - iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig - iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig - iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() - iio: light: opt3001: add missing full-scale range value - Bluetooth: Remove debugfs directory on module init failure - Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 - xhci: Fix incorrect stream context type macro - USB: serial: option: add support for Quectel EG916Q-GL - USB: serial: option: add Telit FN920C04 MBIM compositions - parport: Proper fix for array out-of-bounds access - x86/apic: Always explicitly disarm TSC-deadline timer - nilfs2: propagate directory read errors from nilfs_find_entry() - clk: Fix pointer casting to prevent oops in devm_clk_release() - clk: Fix slab-out-of-bounds error in devm_clk_release() - RDMA/bnxt_re: Fix incorrect AVID type in WQE structure - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP - RDMA/bnxt_re: Return more meaningful error - drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation - macsec: don't increment counters for an unrelated SA - net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() - net: systemport: fix potential memory leak in bcm_sysport_xmit() - usb: typec: altmode should keep reference to parent - Bluetooth: bnep: fix wild-memory-access in proto_unregister - arm64:uprobe fix the uprobe SWBP_INSN in big-endian - arm64: probes: Fix uprobes for big-endian kernels - KVM: s390: gaccess: Refactor gpa and length calculation - KVM: s390: gaccess: Refactor access address range check - KVM: s390: gaccess: Cleanup access to guest pages - KVM: s390: gaccess: Check if guest address is in memslot - udf: fix uninit-value use in udf_get_fileshortad - jfs: Fix sanity check in dbMount - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() - be2net: fix potential memory leak in be_xmit() - net: usb: usbnet: fix name regression - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() - ALSA: hda/realtek: Update default depop procedure - drm/amd: Guard against bad data for ATIF ACPI method - ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue - nilfs2: fix kernel bug due to missing clearing of buffer delay flag - hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event - selinux: improve error checking in sel_write_load() - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning - xfrm: validate new SA's prefixlen using SA family when sel.family is unset - usb: dwc3: remove generic PHY calibrate() calls - usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc - usb: dwc3: core: Stop processing of pending events if controller is halted - cgroup: Fix potential overflow issue when checking max_depth - wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys - gtp: simplify error handling code in 'gtp_encap_enable()' - gtp: allow -1 to be specified as file description from userspace - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT - bpf: Fix out-of-bounds write in trie_get_next_key() - net: support ip generic csum processing in skb_csum_hwoffload_help - net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension - netfilter: nft_payload: sanitize offset and length before calling skb_checksum() - firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() - net: amd: mvme147: Fix probe banner message - misc: sgi-gru: Don't disable preemption in GRU driver - usbip: tools: Fix detach_port() invalid port error path - usb: phy: Fix API devm_usb_put_phy() can not release the phy - xhci: Fix Link TRB DMA in command ring stopped completion event - Revert "driver core: Fix uevent_show() vs driver detach race" - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower - wifi: ath10k: Fix memory leak in management tx - wifi: iwlegacy: Clear stale interrupts before resuming device - nilfs2: fix potential deadlock with newly created symlinks - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow - nilfs2: fix kernel bug due to missing clearing of checked flag - mm: shmem: fix data-race in shmem_getattr() - vt: prevent kernel-infoleak in con_font_get() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.324 - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator - ARM: dts: rockchip: fix rk3036 acodec node - ARM: dts: rockchip: drop grf reference from rk3036 hdmi - ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin - HID: core: zero-initialize the report buffer - security/keys: fix slab-out-of-bounds in key_task_permission - sctp: properly validate chunk size in sctp_sf_ootb() - can: c_can: fix {rx,tx}_errors statistics - net: hns3: fix kernel crash when uninstalling driver - media: stb0899_algo: initialize cfr before using it - media: dvbdev: prevent the risk of out of memory access - media: dvb_frontend: don't play tricks with underflow values - media: adv7604: prevent underflow condition when reporting colorspace - ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() - media: s5p-jpeg: prevent buffer overflows - media: cx24116: prevent overflows on SNR calculus - media: v4l2-tpg: prevent the risk of a division by zero - drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported - dm cache: correct the number of origin blocks to match the target length - dm cache: fix out-of-bounds access to the dirty bitset when resizing - dm cache: optimize dirty bit checking with find_next_bit when resizing - dm cache: fix potential out-of-bounds access on the first resume - dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow - nfs: Fix KMSAN warning in decode_getfattr_attrs() - btrfs: reinitialize delayed ref list after deleting it from the list - bonding (gcc13): synchronize bond_{a,t}lb_xmit() types - net: bridge: xmit: make sure we have at least eth header len bytes - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format - fs/proc: fix compile warning about variable 'vmcore_mmap_ops' - usb: musb: sunxi: Fix accessing an released usb phy - USB: serial: io_edgeport: fix use after free in debug printk - USB: serial: qcserial: add support for Sierra Wireless EM86xx - USB: serial: option: add Fibocom FG132 0x0112 composition - USB: serial: option: add Quectel RG650V - irqchip/gic-v3: Force propagation of the active state with a read-back - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() - ALSA: pcm: Return 0 when size < start_threshold in capture - ALSA: usb-audio: Add custom mixer status quirks for RME CC devices - ALSA: usb-audio: Support jack detection on Dell dock - ALSA: usb-audio: Add quirks for Dell WD19 dock - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans - ALSA: usb-audio: Add endianness annotations - 9p: Avoid creating multiple slab caches with the same name - HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad - bpf: use kvzmalloc to allocate BPF verifier environment - sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML - powerpc/powernv: Free name on error in opal_event_init() - fs: Fix uninitialized value issue in from_kuid and from_kgid - net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition - 9p: fix slab cache name creation for real https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.325 - netlink: terminate outstanding dump on socket close - ocfs2: uncache inode which has failed entering the group - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint - ocfs2: fix UBSAN warning in ocfs2_verify_volume() - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint - Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set - kbuild: Use uname for LINUX_COMPILE_HOST detection - mm: revert "mm: shmem: fix data-race in shmem_getattr()" - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet - mac80211: fix user-power when emulating chanctx - selftests/watchdog-test: Fix system accidentally reset after watchdog-test - x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB - net: usb: qmi_wwan: add Quectel RG650V - proc/softirqs: replace seq_printf with seq_put_decimal_ull_width - nvme: fix metadata handling in nvme-passthrough - initramfs: avoid filename buffer overrun - m68k: mvme147: Fix SCSI controller IRQ numbers - m68k: mvme16x: Add and use "mvme16x.h" - m68k: mvme147: Reinstate early console - acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() - s390/syscalls: Avoid creation of arch/arch/ directory - hfsplus: don't query the device logical block size multiple times - EDAC/fsl_ddr: Fix bad bit shift operations - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY - crypto: cavium - Fix the if condition to exit loop after timeout - crypto: bcm - add error check in the ahash_hmac_init function - crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() - time: Fix references to _msecs_to_jiffies() handling of values - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() - mmc: mmc_spi: drop buggy snprintf() - ARM: dts: cubieboard4: Fix DCDC5 regulator constraints - regmap: irq: Set lockdep class for hierarchical IRQ domains - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware - drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() - drm/omap: Fix locking in omap_gem_new_dmabuf() - bpf: Fix the xdp_adjust_tail sample prog issue - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() - drm/etnaviv: consolidate hardware fence handling in etnaviv_gpu - drm/etnaviv: dump: fix sparse warnings - drm/etnaviv: fix power register offset on GC300 - drm/etnaviv: hold GPU lock across perfmon sampling - net: rfkill: gpio: Add check for clk_enable() - ALSA: us122l: Use snd_card_free_when_closed() at disconnection - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection - ALSA: 6fire: Release resources at card release - netpoll: Use rcu_access_pointer() in netpoll_poll_lock - trace/trace_event_perf: remove duplicate samples on the first tracepoint event - powerpc/vdso: Flag VDSO64 entry points as functions - mfd: da9052-spi: Change read-mask to write-mask - cpufreq: loongson2: Unregister platform_driver on failure - mtd: rawnand: atmel: Fix possible memory leak - RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey - mfd: rt5033: Fix missing regmap_del_irq_chip() - scsi: bfa: Fix use-after-free in bfad_im_module_exit() - scsi: fusion: Remove unused variable 'rc' - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() - ocfs2: fix uninitialized value in ocfs2_file_read_iter() - powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static - fbdev/sh7760fb: Alloc DMA memory from hardware device - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() - dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format - dt-bindings: clock: axi-clkgen: include AXI clk - clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand - clk: clk-axi-clkgen: make sure to enable the AXI bus clock - perf probe: Correct demangled symbols in C++ program - PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads - PCI: cpqphp: Fix PCIBIOS_* return value confusion - m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x - m68k: coldfire/device.c: only build FEC when HW macros are defined - rpmsg: glink: Add TX_DATA_CONT command while sending - rpmsg: glink: Send READ_NOTIFY command in FIFO full case - rpmsg: glink: Fix GLINK command prefix - rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length - NFSD: Prevent NULL dereference in nfsd4_process_cb_update() - NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() - vfio/pci: Properly hide first-in-list PCIe extended capability - power: supply: core: Remove might_sleep() from power_supply_put() - net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device - tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets - net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration - marvell: pxa168_eth: fix call balance of pep->clk handling routines - net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken - usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() - USB: chaoskey: fail open after removal - USB: chaoskey: Fix possible deadlock chaoskey_list_lock - misc: apds990x: Fix missing pm_runtime_disable() - apparmor: fix 'Do simple duplicate message elimination' - usb: ehci-spear: fix call balance of sehci clk handling routines - ext4: supress data-race warnings in ext4_free_inodes_{count,set}() - ext4: fix FS_IOC_GETFSMAP handling - jfs: xattr: check invalid xattr size more strictly - ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() - PCI: Fix use-after-free of slot->bus on hot remove - tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler - Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices - Revert "usb: gadget: composite: fix OS descriptors w_value logic" - serial: sh-sci: Clean sci_ports[0] after at earlycon exit - Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" - netfilter: ipset: add missing range check in bitmap_ip_uadt - spi: Fix acpi deferred irq probe - ubi: wl: Put source PEB into correct list if trying locking LEB failed - um: ubd: Do not use drvdata in release - um: net: Do not use drvdata in release - serial: 8250: omap: Move pm_runtime_get_sync - um: vector: Do not use drvdata in release - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled - block: fix ordering between checking BLK_MQ_S_STOPPED request adding - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values - media: wl128x: Fix atomicity violation in fmc_send_cmd() - usb: dwc3: gadget: Fix checking for number of TRBs left - lib: string_helpers: silence snprintf() output truncation warning - NFSD: Prevent a potential integer overflow - rpmsg: glink: Propagate TX failures in intentless mode as well - um: Fix the return value of elf_core_copy_task_fpregs - NFSv4.0: Fix a use-after-free problem in the asynchronous open() - rtc: check if __rtc_read_time was successful in rtc_timer_do_work() - ubifs: Correct the total block count by deducting journal reservation - ubi: fastmap: Fix duplicate slab cache names while attaching - jffs2: fix use of uninitialized variable - block: return unsigned int from bdev_io_min - 9p/xen: fix init sequence - 9p/xen: fix release of IRQ - modpost: remove incorrect code in do_eisa_entry() - sh: intc: Fix use-after-free bug in register_intc_controller() Critical TuxCare License Agreement CVE-2026-53043 CVE-2023-6270 CVE-2026-31431 Debian 10 * SECURITY UPDATE: arbitrary code execution via CR in config values - debian/patches/CVE-2025-48384.patch: quote config values containing a carriage return so that it is not stripped when read back - CVE-2025-48384 Important TuxCare License Agreement CVE-2025-48384 Debian 10 * SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz): DCH_to_char() copies the timezone abbreviation into a DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and any client can select a longer POSIX abbreviation via SET TIME ZONE (CVSS 8.8, arbitrary code execution as the database OS user) - debian/patches/CVE-2026-14669.patch: Reject POSIX timezone abbreviations that would overflow the TZ/tz item budget in DCH_to_char() with an error instead of strcpy()ing them past the palloc'd buffer (upstream commit 12a620686, shipped in 14.24 via the REL_14_STABLE carrier 5fb3c63; applies verbatim) - CVE-2026-14669 Important TuxCare License Agreement CVE-2026-14669 Debian 10 * SECURITY UPDATE: Heap buffer overflow in set_sofo() in src/spellfile.c: a crafted spell file with an SN_SAL section before an SN_SOFO section leaves sl_sal_first[] entries at -1, so the counting loop under-counts multi-byte mapping lists and later writes run past the end of an undersized heap allocation - debian/patches/CVE-2026-73072.patch: reset sl_sal_first[] with vim_memset() at the top of the SN_SOFO counting loop in set_sofo(), as done upstream in patch 9.2.0846, so entries left at -1 by a preceding set_sal_first() can no longer skew the item counts - CVE-2026-73072 * SECURITY UPDATE: Code execution via a crafted vimball archive: a member named .VimballRecord overwrites the un-vimball bookkeeping file with attacker-chosen Ex commands that are later :executed verbatim by vimball#RmVimball(), allowing arbitrary OS command execution through :! - debian/patches/CVE-2026-73076.patch: forbid extracting a vimball member named .VimballRecord, record file deletions with string() quoting, and make vimball#RmVimball() execute only whitelisted call delete('...') entries instead of the whole record line (upstream patch 9.2.0847 adapted to vimball v37) - CVE-2026-73076 * SECURITY UPDATE: Code injection in netrw bookmark, history and target menus: paths are interpolated into :execute'd :menu commands escaped with g:netrw_menu_escape, which lacks the Ex separator '|', so a crafted directory path breaks out of the :menu command and runs arbitrary Ex/shell commands - debian/patches/CVE-2026-73078.patch: add '|' to g:netrw_menu_escape, escape the :e menu targets with escape(fnameescape(...),'|') in s:NetrwBookmarkMenu(), and quote the netrw#MakeTgt() arguments with string() in s:NetrwTgtMenu() (upstream patch 9.2.0840 adapted to netrw v156) - CVE-2026-73078 Important TuxCare License Agreement CVE-2026-73076 CVE-2026-73078 CVE-2026-73072 Debian 10 * SECURITY UPDATE: Path traversal in pg_rewind: file, directory and symlink paths received from the source server over libpq were acted on without validation, so a rogue origin could make pg_rewind write, truncate or unlink files outside the target data directory - debian/patches/CVE-2026-6475.patch: Add path_is_safe_for_extraction() in src/port/path.c, which canonicalises a path and requires it to stay relative and below the current directory, and gate every pg_rewind target file/dir/symlink operation on it with pg_fatal() (upstream commit 498829dca4; the pg_basebackup astreamer half of that commit is v15+ and absent from 9.6) - CVE-2026-6475: path traversal in pg_rewind target file operations via unvalidated paths supplied by the source server Moderate TuxCare License Agreement CVE-2026-6475 /etc/els-release Debian 10 LTS \(ELS by TuxCare\) 1 libtomcat9-embed-java libtomcat9-java tomcat9 tomcat9-admin tomcat9-common tomcat9-docs tomcat9-examples tomcat9-user apache2 apache2-bin apache2-data apache2-dev apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-pristine apache2-utils libapache2-mod-md libapache2-mod-proxy-uwsgi lemon libsqlite3-0 libsqlite3-dev libsqlite3-tcl sqlite3 sqlite3-doc libnginx-mod-http-auth-pam libnginx-mod-http-cache-purge libnginx-mod-http-dav-ext libnginx-mod-http-echo libnginx-mod-http-fancyindex libnginx-mod-http-geoip libnginx-mod-http-headers-more-filter libnginx-mod-http-image-filter libnginx-mod-http-lua libnginx-mod-http-ndk libnginx-mod-http-perl libnginx-mod-http-subs-filter libnginx-mod-http-uploadprogress libnginx-mod-http-upstream-fair libnginx-mod-http-xslt-filter libnginx-mod-mail libnginx-mod-nchan libnginx-mod-rtmp libnginx-mod-stream nginx nginx-common nginx-doc nginx-extras nginx-full nginx-light busybox busybox-static busybox-syslogd udhcpc udhcpd openvpn libapache2-mod-php7.3 libphp7.3-embed php7.3 php7.3-bcmath php7.3-bz2 php7.3-cgi php7.3-cli php7.3-common php7.3-curl php7.3-dba php7.3-dev php7.3-enchant php7.3-fpm php7.3-gd php7.3-gmp php7.3-imap php7.3-interbase php7.3-intl php7.3-json php7.3-ldap php7.3-mbstring php7.3-mysql php7.3-odbc php7.3-opcache php7.3-pgsql php7.3-phpdbg php7.3-pspell php7.3-readline php7.3-recode php7.3-snmp php7.3-soap php7.3-sqlite3 php7.3-sybase php7.3-tidy php7.3-xml php7.3-xmlrpc php7.3-xsl php7.3-zip ctdb libnss-winbind libpam-winbind libsmbclient libsmbclient-dev libwbclient-dev libwbclient0 python-samba registry-tools samba samba-common samba-common-bin samba-dev samba-dsdb-modules samba-libs samba-testsuite samba-vfs-modules smbclient winbind binutils binutils-aarch64-linux-gnu binutils-alpha-linux-gnu binutils-arm-linux-gnueabi binutils-arm-linux-gnueabihf binutils-common binutils-dev binutils-doc binutils-for-build binutils-for-host binutils-hppa-linux-gnu binutils-hppa64-linux-gnu binutils-i686-gnu binutils-i686-kfreebsd-gnu binutils-i686-linux-gnu binutils-ia64-linux-gnu binutils-m68k-linux-gnu binutils-mips-linux-gnu binutils-mips64el-linux-gnuabi64 binutils-mipsel-linux-gnu binutils-multiarch binutils-multiarch-dev binutils-powerpc-linux-gnu binutils-powerpc-linux-gnuspe binutils-powerpc64-linux-gnu binutils-powerpc64le-linux-gnu binutils-riscv64-linux-gnu binutils-s390x-linux-gnu binutils-sh4-linux-gnu binutils-source binutils-sparc64-linux-gnu binutils-x86-64-kfreebsd-gnu binutils-x86-64-linux-gnu binutils-x86-64-linux-gnux32 libbinutils libxml2 libxml2-dev libxml2-doc libxml2-utils python-libxml2 python3-libxml2 libperl-dev libperl5.28 perl perl-base perl-debug perl-doc perl-modules-5.28 sudo sudo-ldap bash bash-builtins bash-doc bash-static squid squid-cgi squid-common squid-purge squid3 squidclient vim vim-athena vim-common vim-doc vim-gtk vim-gtk3 vim-gui-common vim-nox vim-runtime vim-tiny xxd zsh zsh-common zsh-dev zsh-doc zsh-static tar tar-scripts libodbc1 odbcinst odbcinst1debian2 unixodbc unixodbc-dev ansible ansible-doc expat libexpat1 libexpat1-dev dmidecode bind9 bind9-doc bind9-host bind9utils dnsutils libbind-dev libbind-export-dev libbind9-161 libdns-export1104 libdns1104 libirs-export161 libirs161 libisc-export1100 libisc1100 libisccc-export161 libisccc161 libisccfg-export163 libisccfg163 liblwres161 wget quagga quagga-bgpd quagga-core quagga-doc quagga-isisd quagga-ospf6d quagga-ospfd quagga-pimd quagga-ripd quagga-ripngd libglib2.0-0 libglib2.0-bin libglib2.0-data libglib2.0-dev libglib2.0-dev-bin libglib2.0-doc libglib2.0-tests rsync libnss-myhostname libnss-mymachines libnss-resolve libnss-systemd libpam-systemd libsystemd-dev libsystemd0 libudev-dev libudev1 systemd systemd-container systemd-coredump systemd-journal-remote systemd-sysv systemd-tests udev dpkg dpkg-dev dselect libdpkg-dev libdpkg-perl gdb gdb-minimal gdb-multiarch gdb-source gdbserver libecpg-compat3 libecpg-dev libecpg6 libpgtypes3 libpq-dev libpq5 postgresql-11 postgresql-client-11 postgresql-doc-11 postgresql-plperl-11 postgresql-plpython-11 postgresql-plpython3-11 postgresql-pltcl-11 postgresql-server-dev-11 openssh-client openssh-server openssh-sftp-server openssh-tests ssh ssh-askpass-gnome git git-all git-cvs git-daemon-run git-daemon-sysvinit git-doc git-el git-email git-gui git-man git-mediawiki git-svn gitk gitweb cups cups-bsd cups-client cups-common cups-core-drivers cups-daemon cups-ipp-utils cups-ppdc cups-server-common libcups2 libcups2-dev libcupsimage2 libcupsimage2-dev dirmngr gnupg gnupg-agent gnupg-l10n gnupg-utils gnupg2 gpg gpg-agent gpg-wks-client gpg-wks-server gpgconf gpgsm gpgv gpgv-static gpgv-win32 gpgv2 scdaemon libssl-dev libssl-doc libssl1.1 openssl curl libcurl3-gnutls libcurl3-nss libcurl4 libcurl4-doc libcurl4-gnutls-dev libcurl4-nss-dev libcurl4-openssl-dev krb5-admin-server krb5-doc krb5-gss-samples krb5-k5tls krb5-kdc krb5-kdc-ldap krb5-kpropd krb5-locales krb5-multidev krb5-otp krb5-pkinit krb5-user libgssapi-krb5-2 libgssrpc4 libk5crypto3 libkadm5clnt-mit11 libkadm5srv-mit11 libkdb5-9 libkrad-dev libkrad0 libkrb5-3 libkrb5-dev libkrb5support0 imagemagick imagemagick-6-common imagemagick-6-doc imagemagick-6.q16 imagemagick-6.q16hdri imagemagick-common imagemagick-doc libimage-magick-perl libimage-magick-q16-perl libimage-magick-q16hdri-perl libmagick++-6-headers libmagick++-6.q16-8 libmagick++-6.q16-dev libmagick++-6.q16hdri-8 libmagick++-6.q16hdri-dev libmagick++-dev libmagickcore-6-arch-config libmagickcore-6-headers libmagickcore-6.q16-6 libmagickcore-6.q16-6-extra libmagickcore-6.q16-dev libmagickcore-6.q16hdri-6 libmagickcore-6.q16hdri-6-extra libmagickcore-6.q16hdri-dev libmagickcore-dev libmagickwand-6-headers libmagickwand-6.q16-6 libmagickwand-6.q16-dev libmagickwand-6.q16hdri-6 libmagickwand-6.q16hdri-dev libmagickwand-dev perlmagick lib32ncurses-dev lib32ncurses6 lib32ncursesw6 lib32tinfo6 libncurses-dev libncurses5 libncurses5-dev libncurses6 libncursesw5 libncursesw5-dev libncursesw6 libtinfo-dev libtinfo5 libtinfo6 ncurses-base ncurses-bin ncurses-doc ncurses-examples ncurses-term idle-python2.7 libpython2.7 libpython2.7-dev libpython2.7-minimal libpython2.7-stdlib libpython2.7-testsuite python2.7 python2.7-dev python2.7-doc python2.7-examples python2.7-minimal libnghttp2-14 libnghttp2-dev libnghttp2-doc nghttp2 nghttp2-client nghttp2-proxy nghttp2-server redis redis-sentinel redis-server redis-tools libssh2-1 libssh2-1-dev postfix postfix-cdb postfix-doc postfix-ldap postfix-lmdb postfix-mysql postfix-pcre postfix-pgsql postfix-sqlite idle-python3.7 libpython3.7 libpython3.7-dev libpython3.7-minimal libpython3.7-stdlib libpython3.7-testsuite python3.7 python3.7-dev python3.7-doc python3.7-examples python3.7-minimal python3.7-venv libtasn1-6 libtasn1-6-dev libtasn1-bin libtasn1-doc libecpg-compat3-9.6 libecpg-dev-9.6 libecpg6-9.6 libpgtypes3-9.6 libpq-dev-9.6 libpq5-9.6 postgresql-9.6 postgresql-client-9.6 postgresql-contrib-9.6 postgresql-doc-9.6 postgresql-plperl-9.6 postgresql-plpython-9.6 postgresql-plpython3-9.6 postgresql-pltcl-9.6 postgresql-server-dev-9.6 haproxy haproxy-doc vim-haproxy gzip gzip-win32 composer glibc-doc glibc-source libc-bin libc-dev-bin libc-l10n libc6 libc6-dev libc6-dev-i386 libc6-dev-x32 libc6-i386 libc6-pic libc6-x32 locales locales-all multiarch-support nscd hyperv-daemons libbpf-dev libbpf4.19 libcpupower-dev libcpupower1 linux-compiler-gcc-8-x86 linux-config-4.19 linux-cpupower linux-doc-4.19 linux-headers-4.19.0-28-all linux-headers-4.19.0-28-all-amd64 linux-headers-4.19.0-28-amd64 linux-headers-4.19.0-28-common linux-image-4.19.0-28-amd64-unsigned linux-image-amd64-signed-template linux-kbuild-4.19 linux-libc-dev linux-perf-4.19 linux-source-4.19 linux-support-4.19.0-28 0:9.0.31-1~deb10u12+tuxcare.els1 amd64 0:2.4.59-1~deb10u1+tuxcare.els2 0:2.4.59-1~deb10u1+tuxcare.els2 amd64 0:3.31.1-4ubuntu0.7+tuxcare.els1 0:3.31.1-4ubuntu0.7+tuxcare.els1 amd64 0:1.14.2-2+deb10u5+tuxcare.els1 0:1.14.2-2+deb10u5+tuxcare.els1 amd64 1:1.30.1-4+tuxcare.els1 1:1.30.1-4+tuxcare.els1 amd64 0:2.4.7-1+deb10u1+tuxcare.els1 amd64 0:7.3.31-1~deb10u7+tuxcare.els1 0:7.3.31-1~deb10u7+tuxcare.els1 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els1 2:4.9.5+dfsg-5+deb10u5+tuxcare.els1 amd64 0:2.31.1-16+tuxcare.els1 0:2.31.1-16+tuxcare.els1 amd64 0:2.9.4+dfsg1-7+deb10u6+tuxcare.els1 0:2.9.4+dfsg1-7+deb10u6+tuxcare.els1 amd64 0:2.31.1-16+tuxcare.els2 0:2.31.1-16+tuxcare.els2 amd64 0:5.28.1-6+deb10u1+tuxcare.els1 0:5.28.1-6+deb10u1+tuxcare.els1 amd64 0:1.8.27-1+deb10u6+tuxcare.els1 amd64 0:5.0-4+tuxcare.els1 0:5.0-4+tuxcare.els1 amd64 0:4.6-1+deb10u10+tuxcare.els1 0:4.6-1+deb10u10+tuxcare.els1 0:9.0.31-1~deb10u12+tuxcare.els3 amd64 2:8.1.0875-5+deb10u6+tuxcare.els2 2:8.1.0875-5+deb10u6+tuxcare.els2 amd64 0:7.3.31-1~deb10u7+tuxcare.els2 0:7.3.31-1~deb10u7+tuxcare.els2 amd64 0:2.31.1-16+tuxcare.els4 0:2.31.1-16+tuxcare.els4 amd64 0:5.7.1-1+deb10u1+tuxcare.els1 0:5.7.1-1+deb10u1+tuxcare.els1 amd64 0:1.30+dfsg-6+deb10u1+tuxcare.els1 amd64 2:8.1.0875-5+deb10u6+tuxcare.els3 2:8.1.0875-5+deb10u6+tuxcare.els3 amd64 0:2.4.59-1~deb10u1+tuxcare.els3 0:2.4.59-1~deb10u1+tuxcare.els3 amd64 1:1.30.1-4+tuxcare.els2 1:1.30.1-4+tuxcare.els2 amd64 0:4.6-1+deb10u10+tuxcare.els2 0:4.6-1+deb10u10+tuxcare.els2 amd64 0:2.3.6-0.1+tuxcare.els1 amd64 2:8.1.0875-5+deb10u6+tuxcare.els5 2:8.1.0875-5+deb10u6+tuxcare.els5 amd64 0:2.31.1-16+tuxcare.els5 0:2.31.1-16+tuxcare.els5 amd64 0:2.31.1-16+tuxcare.els6 0:2.31.1-16+tuxcare.els6 0:2.7.7+dfsg-1+deb10u2+tuxcare.els1 amd64 0:2.2.6-2+deb10u7+tuxcare.els1 amd64 0:2.31.1-16+tuxcare.els8 0:2.31.1-16+tuxcare.els8 amd64 2:8.1.0875-5+deb10u6+tuxcare.els9 2:8.1.0875-5+deb10u6+tuxcare.els9 amd64 1:1.30.1-4+tuxcare.els3 1:1.30.1-4+tuxcare.els3 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els2 2:4.9.5+dfsg-5+deb10u5+tuxcare.els2 amd64 2:8.1.0875-5+deb10u6+tuxcare.els13 2:8.1.0875-5+deb10u6+tuxcare.els13 amd64 0:3.2-1+tuxcare.els1 amd64 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els1 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els1 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els3 2:4.9.5+dfsg-5+deb10u5+tuxcare.els3 amd64 0:1.20.1-1.1+tuxcare.els1 amd64 0:1.2.4-3+tuxcare.els1 0:1.2.4-3+tuxcare.els1 amd64 0:2.58.3-2+deb10u6+tuxcare.els1 0:2.58.3-2+deb10u6+tuxcare.els1 amd64 0:3.1.3-6+tuxcare.els1 amd64 0:241-7~deb10u10+tuxcare.els1 amd64 0:4.6-1+deb10u10+tuxcare.els3 0:4.6-1+deb10u10+tuxcare.els3 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els4 2:4.9.5+dfsg-5+deb10u5+tuxcare.els4 amd64 0:1.19.8+tuxcare.els1 0:1.19.8+tuxcare.els1 amd64 0:8.2.1-2+tuxcare.els1 0:8.2.1-2+tuxcare.els1 amd64 0:11.22-0+deb10u2+tuxcare.els1 0:11.22-0+deb10u2+tuxcare.els1 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els5 2:4.9.5+dfsg-5+deb10u5+tuxcare.els5 amd64 2:8.1.0875-5+deb10u6+tuxcare.els14 2:8.1.0875-5+deb10u6+tuxcare.els14 amd64 1:7.9p1-10+deb10u4+tuxcare.els1 1:7.9p1-10+deb10u4+tuxcare.els1 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els7 2:4.9.5+dfsg-5+deb10u5+tuxcare.els7 amd64 1:7.9p1-10+deb10u4+tuxcare.els2 1:7.9p1-10+deb10u4+tuxcare.els2 amd64 1:2.20.1-2+deb10u9+tuxcare.els1 1:2.20.1-2+deb10u9+tuxcare.els1 amd64 0:7.3.31-1~deb10u7+tuxcare.els3 0:7.3.31-1~deb10u7+tuxcare.els3 amd64 0:2.2.10-6+deb10u10+tuxcare.els1 0:2.2.10-6+deb10u10+tuxcare.els1 amd64 1:2.20.1-2+deb10u9+tuxcare.els2 1:2.20.1-2+deb10u9+tuxcare.els2 amd64 1:2.20.1-2+deb10u9+tuxcare.els3 1:2.20.1-2+deb10u9+tuxcare.els3 amd64 0:2.2.12-1+deb10u2+tuxcare.els1 0:2.2.12-1+deb10u2+tuxcare.els1 amd64 0:2.2.6-2+deb10u7+tuxcare.els2 amd64 0:1.1.1n-0+deb10u6+tuxcare.els1 0:1.1.1n-0+deb10u6+tuxcare.els1 amd64 0:1.1.1n-0+deb10u6+tuxcare.els2 0:1.1.1n-0+deb10u6+tuxcare.els2 amd64 0:2.58.3-2+deb10u6+tuxcare.els2 0:2.58.3-2+deb10u6+tuxcare.els2 amd64 0:7.64.0-4+deb10u9+tuxcare.els1 0:7.64.0-4+deb10u9+tuxcare.els1 amd64 2:8.1.0875-5+deb10u6+tuxcare.els15 2:8.1.0875-5+deb10u6+tuxcare.els15 amd64 0:1.17-3+deb10u6+tuxcare.els1 0:1.17-3+deb10u6+tuxcare.els1 amd64 0:7.64.0-4+deb10u9+tuxcare.els2 0:7.64.0-4+deb10u9+tuxcare.els2 amd64 0:7.64.0-4+deb10u9+tuxcare.els3 0:7.64.0-4+deb10u9+tuxcare.els3 amd64 0:2.2.6-2+deb10u7+tuxcare.els3 0:9.0.31-1~deb10u12+tuxcare.els4 amd64 2:8.1.0875-5+deb10u6+tuxcare.els16 2:8.1.0875-5+deb10u6+tuxcare.els16 amd64 0:4.6-1+deb10u10+tuxcare.els4 0:4.6-1+deb10u10+tuxcare.els4 amd64 0:2.2.12-1+deb10u2+tuxcare.els2 0:2.2.12-1+deb10u2+tuxcare.els2 amd64 0:2.31.1-16+tuxcare.els10 0:2.31.1-16+tuxcare.els10 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els3 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els3 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els4 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els4 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els1 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els1 amd64 0:2.2.10-6+deb10u10+tuxcare.els2 0:2.2.10-6+deb10u10+tuxcare.els2 amd64 2:8.1.0875-5+deb10u6+tuxcare.els17 2:8.1.0875-5+deb10u6+tuxcare.els17 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els5 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els5 amd64 0:6.1+20181013-2+deb10u5+tuxcare.els1 0:6.1+20181013-2+deb10u5+tuxcare.els1 amd64 0:2.31.1-16+tuxcare.els11 0:2.31.1-16+tuxcare.els11 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els6 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els6 0:2.7.16-2+deb10u4+tuxcare.els1 amd64 0:2.7.16-2+deb10u4+tuxcare.els1 amd64 1:7.9p1-10+deb10u4+tuxcare.els3 1:7.9p1-10+deb10u4+tuxcare.els3 amd64 2:8.1.0875-5+deb10u6+tuxcare.els18 2:8.1.0875-5+deb10u6+tuxcare.els18 amd64 1:7.9p1-10+deb10u4+tuxcare.els4 1:7.9p1-10+deb10u4+tuxcare.els4 amd64 0:1.36.0-2+deb10u3+tuxcare.els1 0:1.36.0-2+deb10u3+tuxcare.els1 5:5.0.14-1+deb10u5+tuxcare.els2 amd64 5:5.0.14-1+deb10u5+tuxcare.els2 amd64 0:1.1.1n-0+deb10u6+tuxcare.els3 0:1.1.1n-0+deb10u6+tuxcare.els3 amd64 0:2.4.59-1~deb10u1+tuxcare.els4 0:2.4.59-1~deb10u1+tuxcare.els4 amd64 0:2.2.10-6+deb10u10+tuxcare.els3 0:2.2.10-6+deb10u10+tuxcare.els3 amd64 0:2.31.1-16+tuxcare.els12 0:2.31.1-16+tuxcare.els12 amd64 0:1.14.2-2+deb10u5+tuxcare.els2 0:1.14.2-2+deb10u5+tuxcare.els2 amd64 0:2.2.6-2+deb10u7+tuxcare.els4 amd64 0:1.8.0-2.1+deb10u1+tuxcare.els1 amd64 0:3.4.23-0+deb10u2+tuxcare.els1 0:3.4.23-0+deb10u2+tuxcare.els1 amd64 0:7.3.31-1~deb10u7+tuxcare.els5 0:7.3.31-1~deb10u7+tuxcare.els5 0:3.7.3-2+deb10u7+tuxcare.els2 amd64 0:3.7.3-2+deb10u7+tuxcare.els2 0:3.7.3-2+deb10u7+tuxcare.els3 amd64 0:3.7.3-2+deb10u7+tuxcare.els3 amd64 0:2.4.59-1~deb10u1+tuxcare.els5 0:2.4.59-1~deb10u1+tuxcare.els5 amd64 0:7.3.31-1~deb10u7+tuxcare.els6 0:7.3.31-1~deb10u7+tuxcare.els6 5:5.0.14-1+deb10u5+tuxcare.els3 amd64 5:5.0.14-1+deb10u5+tuxcare.els3 amd64 0:7.64.0-4+deb10u9+tuxcare.els4 0:7.64.0-4+deb10u9+tuxcare.els4 amd64 0:2.2.6-2+deb10u7+tuxcare.els5 amd64 0:4.13-3+tuxcare.els1 0:4.13-3+tuxcare.els1 amd64 0:11.22-0+deb10u2+tuxcare.els2 0:11.22-0+deb10u2+tuxcare.els2 amd64 0:2.4.59-1~deb10u1+tuxcare.els6 0:2.4.59-1~deb10u1+tuxcare.els6 amd64 0:1.14.2-2+deb10u5+tuxcare.els3 0:1.14.2-2+deb10u5+tuxcare.els3 amd64 0:3.1.3-6+tuxcare.els2 amd64 0:7.3.31-1~deb10u7+tuxcare.els7 0:7.3.31-1~deb10u7+tuxcare.els7 amd64 2:8.1.0875-5+deb10u6+tuxcare.els19 2:8.1.0875-5+deb10u6+tuxcare.els19 0:9.0.31-1~deb10u12+tuxcare.els5 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els7 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els7 amd64 0:3.1.3-6+tuxcare.els3 amd64 2:8.1.0875-5+deb10u6+tuxcare.els20 2:8.1.0875-5+deb10u6+tuxcare.els20 amd64 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els2 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els2 amd64 0:5.28.1-6+deb10u1+tuxcare.els2 0:5.28.1-6+deb10u1+tuxcare.els2 amd64 0:1.8.27-1+deb10u6+tuxcare.els2 amd64 0:2.2.6-2+deb10u7+tuxcare.els6 amd64 0:9.6.24-0+deb10u1+tuxcare.els2 0:9.6.24-0+deb10u1+tuxcare.els2 amd64 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els3 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els3 0:2.7.16-2+deb10u4+tuxcare.els2 amd64 0:2.7.16-2+deb10u4+tuxcare.els2 amd64 0:1.1.1n-0+deb10u6+tuxcare.els4 0:1.1.1n-0+deb10u6+tuxcare.els4 0:3.7.3-2+deb10u7+tuxcare.els5 amd64 0:3.7.3-2+deb10u7+tuxcare.els5 amd64 0:2.4.59-1~deb10u1+tuxcare.els8 0:2.4.59-1~deb10u1+tuxcare.els8 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els8 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els8 amd64 2:8.1.0875-5+deb10u6+tuxcare.els22 2:8.1.0875-5+deb10u6+tuxcare.els22 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els9 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els9 amd64 0:3.31.1-4ubuntu0.7+tuxcare.els2 0:3.31.1-4ubuntu0.7+tuxcare.els2 amd64 0:1.8.19-1+deb10u5+tuxcare.els1 0:1.8.19-1+deb10u5+tuxcare.els1 amd64 2:8.1.0875-5+deb10u6+tuxcare.els23 2:8.1.0875-5+deb10u6+tuxcare.els23 amd64 2:8.1.0875-5+deb10u6+tuxcare.els24 2:8.1.0875-5+deb10u6+tuxcare.els24 amd64 0:2.4.59-1~deb10u1+tuxcare.els9 0:2.4.59-1~deb10u1+tuxcare.els9 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els8 2:4.9.5+dfsg-5+deb10u5+tuxcare.els8 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els6 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els6 amd64 0:2.4.59-1~deb10u1+tuxcare.els11 0:2.4.59-1~deb10u1+tuxcare.els11 amd64 0:2.4.59-1~deb10u1+tuxcare.els10 0:2.4.59-1~deb10u1+tuxcare.els10 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11 amd64 0:1.9-3+deb10u1+tuxcare.els1 0:1.9-3+deb10u1+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els12 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els12 amd64 2:8.1.0875-5+deb10u6+tuxcare.els25 2:8.1.0875-5+deb10u6+tuxcare.els25 amd64 0:1.20.1-1.1+tuxcare.els2 amd64 0:1.8.0-2.1+deb10u1+tuxcare.els2 0:2.7.16-2+deb10u4+tuxcare.els3 amd64 0:2.7.16-2+deb10u4+tuxcare.els3 0:3.7.3-2+deb10u7+tuxcare.els6 amd64 0:3.7.3-2+deb10u7+tuxcare.els6 amd64 0:2.58.3-2+deb10u6+tuxcare.els5 0:2.58.3-2+deb10u6+tuxcare.els5 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els13 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els13 amd64 0:4.6-1+deb10u10+tuxcare.els5 0:4.6-1+deb10u10+tuxcare.els5 amd64 1:7.9p1-10+deb10u4+tuxcare.els6 1:7.9p1-10+deb10u4+tuxcare.els6 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els14 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els14 0:9.0.31-1~deb10u12+tuxcare.els6 amd64 1:7.9p1-10+deb10u4+tuxcare.els5 1:7.9p1-10+deb10u4+tuxcare.els5 amd64 0:1.14.2-2+deb10u5+tuxcare.els4 0:1.14.2-2+deb10u5+tuxcare.els4 amd64 0:2.2.10-6+deb10u10+tuxcare.els4 0:2.2.10-6+deb10u10+tuxcare.els4 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els5 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els5 amd64 2:8.1.0875-5+deb10u6+tuxcare.els26 2:8.1.0875-5+deb10u6+tuxcare.els26 amd64 0:2.4.59-1~deb10u1+tuxcare.els12 0:2.4.59-1~deb10u1+tuxcare.els12 0:9.0.31-1~deb10u12+tuxcare.els7 0:2.7.16-2+deb10u4+tuxcare.els4 amd64 0:2.7.16-2+deb10u4+tuxcare.els4 amd64 0:2.31.1-16+tuxcare.els13 0:2.31.1-16+tuxcare.els13 amd64 0:2.2.6-2+deb10u7+tuxcare.els7 amd64 0:3.1.3-6+tuxcare.els4 amd64 0:5.28.1-6+deb10u1+tuxcare.els5 0:5.28.1-6+deb10u1+tuxcare.els5 amd64 2:4.9.5+dfsg-5+deb10u5+tuxcare.els9 2:4.9.5+dfsg-5+deb10u5+tuxcare.els9 amd64 0:5.28.1-6+deb10u1+tuxcare.els4 0:5.28.1-6+deb10u1+tuxcare.els4 amd64 0:2.4.7-1+deb10u1+tuxcare.els2 0:9.0.31-1~deb10u12+tuxcare.els8 amd64 0:7.64.0-4+deb10u9+tuxcare.els5 0:7.64.0-4+deb10u9+tuxcare.els5 amd64 0:7.3.31-1~deb10u7+tuxcare.els8 0:7.3.31-1~deb10u7+tuxcare.els8 amd64 0:2.2.6-2+deb10u7+tuxcare.els8 amd64 1:1.30.1-4+tuxcare.els4 1:1.30.1-4+tuxcare.els4 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7 0:1.8.4-1+deb10u4+tuxcare.els1 amd64 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els4 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els4 amd64 0:2.58.3-2+deb10u6+tuxcare.els6 0:2.58.3-2+deb10u6+tuxcare.els6 0:2.28-10+deb10u4+tuxcare.els1 amd64 0:2.28-10+deb10u4+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els16 8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els16 amd64 0:1.1.1n-0+deb10u6+tuxcare.els5 0:1.1.1n-0+deb10u6+tuxcare.els5 amd64 0:9.6.24-0+deb10u1+tuxcare.els3 0:9.6.24-0+deb10u1+tuxcare.els3 amd64 0:1.36.0-2+deb10u3+tuxcare.els2 0:1.36.0-2+deb10u3+tuxcare.els2 amd64 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els5 1:9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els5 amd64 0:241-7~deb10u10+tuxcare.els3 0:3.7.3-2+deb10u7+tuxcare.els7 amd64 0:3.7.3-2+deb10u7+tuxcare.els7 amd64 0:1.8.0-2.1+deb10u1+tuxcare.els3 amd64 1:7.9p1-10+deb10u4+tuxcare.els7 1:7.9p1-10+deb10u4+tuxcare.els7 (^4\.19\.0\-(?:\d{3,}|[3-9]\d|2[8-9])(?:\-tuxcare\.els\d+)?\-\w*$) amd64 0:4.19.325-1+tuxcare.els1 0:4.19.325-1+tuxcare.els1 amd64 1:2.20.1-2+deb10u9+tuxcare.els4 1:2.20.1-2+deb10u9+tuxcare.els4 amd64 0:9.6.24-0+deb10u1+tuxcare.els4 0:9.6.24-0+deb10u1+tuxcare.els4 amd64 2:8.1.0875-5+deb10u6+tuxcare.els27 2:8.1.0875-5+deb10u6+tuxcare.els27 amd64 0:9.6.24-0+deb10u1+tuxcare.els5 0:9.6.24-0+deb10u1+tuxcare.els5