Tuxcare Errata System 0.0.1 5.10 2026-05-16T14:39:28 Ubuntu 20.04 LTS * SECURITY UPDATE: The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly - debian/patches/CVE-2023-44487.patch: HTTP/2 - per-iteration stream handling limit. - CVE-2023-44487 Important TuxCare License Agreement CVE-2023-44487 Ubuntu 20.04 LTS * SECURITY UPDATE: path Equivalence Vulnerability - debian/patches/CVE-2025-24813.patch: enhance lifecycle of temporary files used by partial PUT to delete temporary file right after finishing request processing - CVE-2025-24813 Critical TuxCare License Agreement CVE-2025-24813 Ubuntu 20.04 LTS * SECURITY UPDATE: Denial of service - debian/patches/CVE-2023-44487.patch: Improvements to HTTP/2 overhead protection - CVE-2023-44487 Important TuxCare License Agreement CVE-2023-44487 Ubuntu 20.04 LTS * SECURITY UPDATE: OOB access in python API - debian/patches/CVE-2025-32414-pre1.patch: fix SAX driver with character streams in python/drv_libxml2.py. - debian/patches/CVE-2025-32414-1.patch: read at most len/4 characters in python/libxml.c. - debian/patches/CVE-2025-32414-2.patch: add a test in python/tests/Makefile.am, python/tests/unicode.py. - CVE-2025-32414 * SECURITY UPDATE: heap under-read in xmlSchemaIDCFillNodeTables - debian/patches/CVE-2025-32415.patch: fix heap buffer overflow in xmlSchemaIDCFillNodeTables in xmlschemas.c. - CVE-2025-32415 Important TuxCare License Agreement CVE-2025-32414 CVE-2025-32415 Ubuntu 20.04 LTS * SECURITY UPDATE: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability - debian/patches/CVE-2025-31651.patch: Enforces rewrite rules to preventing bypass of security constraints in specific configurations - CVE-2025-31651 Critical TuxCare License Agreement CVE-2025-31651 Ubuntu 20.04 LTS * CVE-url: https://ubuntu.com/security/CVE-2024-46787 - userfaultfd: fix checks for huge PMDs * CVE-url: https://ubuntu.com/security/CVE-2025-37798 - sch_htb: make htb_qlen_notify() idempotent - sch_drr: make drr_qlen_notify() idempotent - sch_hfsc: make hfsc_qlen_notify() idempotent - sch_qfq: make qfq_qlen_notify() idempotent - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() * CVE-url: https://ubuntu.com/security/CVE-2025-37803 - udmabuf: fix a buf size overflow issue during udmabuf creation * CVE-url: https://ubuntu.com/security/CVE-2025-37785 - ext4: optimize __ext4_check_dir_entry() - ext4: fix OOB read when checking dotdot dir * CVE-url: https://ubuntu.com/security/CVE-2025-22038 - ksmbd: validate zero num_subauth before sub_auth is accessed * CVE-url: https://ubuntu.com/security/CVE-2025-21927 - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() * CVE-url: https://ubuntu.com/security/CVE-2025-21969 - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd * CVE-url: https://ubuntu.com/security/CVE-2025-21855 - ibmvnic: Don't reference skb after sending to VIOS * CVE-url: https://ubuntu.com/security/CVE-2025-21780 - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() * CVE-url: https://ubuntu.com/security/CVE-2023-0386 - ovl: fail on invalid uid/gid mapping at copy up Important TuxCare License Agreement CVE-2025-21969 CVE-2025-37798 CVE-2025-37803 CVE-2024-46787 CVE-2025-37785 CVE-2023-0386 CVE-2025-22038 CVE-2025-21927 CVE-2025-21855 CVE-2025-21780 Ubuntu 20.04 LTS * SECURITY UPDATE: memory vulnerabilities in schematron - debian/patches/CVE-2025-49794_CVE-2025-49796.patch: fix memory safety issues in xmlSchematronReportOutput when parsing XPath elements and memory corruption issue triggered by processing sch:name elements in input XML file - CVE-2025-49794 - CVE-2025-49796 Critical TuxCare License Agreement CVE-2025-49794 CVE-2025-49796 Ubuntu 20.04 LTS * SECURITY UPDATE: restrict users from executing commands on unintended machines - debian/patches/CVE-2025-32462.patch: restricts --host usage to sudo -l only, preventing bypass of host-based sudoers rules and avoiding unintended local privilege escalation - CVE-2025-32462 Important TuxCare License Agreement CVE-2025-32462 Ubuntu 20.04 LTS * SECURITY UPDATE: excessive aggregate terms potentially leading to memory corruption - debian/patches/CVE-2025-6965.patch: fix a potential memory corruption if the number of aggregate terms in a query exceeds the maximum number of columns - CVE-2025-6965 Critical TuxCare License Agreement CVE-2025-6965 Ubuntu 20.04 LTS * SECURITY UPDATE: security vulnerability - debian/patches/CVE-2025-48384.patch: quote values containing CR character in config to prevent unintended stripping of CR - CVE-2025-48384 Important TuxCare License Agreement CVE-2025-48384 Ubuntu 20.04 LTS * SECURITY UPDATE: heap buffer overflow in InterpretImageFilename function - debian/patches/CVE-2025-53014.patch: fix out of bounds read of a single byte in image file interpretation - CVE-2025-53014 Critical TuxCare License Agreement CVE-2025-53014 Ubuntu 20.04 LTS * SECURITY UPDATE: out-of-bounds read in sftp_handle function - debian/patches/CVE-2025-5318.patch: fix possible buffer overrun issue by changing comparison operator in sftp_handle function - CVE-2025-5318 Important TuxCare License Agreement CVE-2025-5318 Ubuntu 20.04 LTS * SECURITY UPDATE: stack-based buffer overflow vulnerability in xmlBuildQName function - debian/patches/CVE-2025-6021.patch: fix integer overflow in xmlBuildQName causing memory safety issue - CVE-2025-6021 Important TuxCare License Agreement CVE-2025-6021 Ubuntu 20.04 LTS * CVE-2024-50047 fix. // CVE-url: https://ubuntu.com/security/CVE-2025-38488 - smb: client: fix use-after-free in crypt_message when using async crypto * CVE-url: https://ubuntu.com/security/CVE-2024-57996 // CVE-url: https://ubuntu.com/security/CVE-2025-37752 - net_sched: sch_sfq: move the limit validation * CVE-url: https://ubuntu.com/security/CVE-2023-52975 - scsi: iscsi: Move pool freeing - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress * CVE-url: https://ubuntu.com/security/CVE-2023-52757 - smb: client: fix potential deadlock when releasing mids * CVE-url: https://ubuntu.com/security/CVE-2025-38083 - net_sched: prio: fix a race in prio_tune() * CVE-url: https://ubuntu.com/security/CVE-2024-49950 - Bluetooth: L2CAP: Fix uaf in l2cap_connect - Bluetooth: hci_core: Fix calling mgmt_device_connected * CVE-url: https://ubuntu.com/security/CVE-2024-50073 - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux * CVE-url: https://ubuntu.com/security/CVE-2025-37797 - net_sched: hfsc: Fix a UAF vulnerability in class handling * CVE-url: https://ubuntu.com/security/CVE-2024-38541 - of: module: add buffer overflow check in of_modalias() * CVE-url: https://ubuntu.com/security/CVE-2025-37997 - netfilter: ipset: fix region locking in hash types * CVE-url: https://ubuntu.com/security/CVE-2024-53051 - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability * CVE-url: https://ubuntu.com/security/CVE-2025-37890 - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice * CVE-url: https://ubuntu.com/security/CVE-2025-37782 - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key * CVE-url: https://ubuntu.com/security/CVE-2024-53185 - smb: client: fix NULL ptr deref in crypto_aead_setkey() * CVE-url: https://ubuntu.com/security/CVE-2024-50047 - smb: client: fix UAF in async decryption * CVE-url: https://ubuntu.com/security/CVE-2024-56662 - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl * Miscellaneous upstream changes - Revert "UBUNTU: SAUCE: fs: hfs/hfsplus: add key_len boundary check to hfs_bnode_read_key" Important TuxCare License Agreement CVE-2025-37752 CVE-2024-56662 CVE-2024-53051 CVE-2024-38541 CVE-2023-52975 CVE-2023-52757 CVE-2024-50073 CVE-2024-50047 CVE-2024-49950 CVE-2024-53185 CVE-2024-57996 CVE-2025-38488 CVE-2025-38083 CVE-2025-37997 CVE-2025-37890 CVE-2025-37797 CVE-2025-37782 Ubuntu 20.04 LTS * SECURITY UPDATE: memory corruption in attribute type handling - debian/patches/CVE-2025-7425.patch: guard against atype corruption to ensure proper ID cleanup and prevent heap-use-after-free - CVE-2025-7425 Important TuxCare License Agreement CVE-2025-7425 Ubuntu 20.04 LTS * SECURITY UPDATE: Inadequate validation in pgsql and pdo_pgsql functions - debian/patches/CVE-2025-1735.patch: add error checks for escape function in pgsql and pdo_pgsql extensions to prevent potential security issues - CVE-2025-1735 * SECURITY UPDATE: Insufficient HTTP header validation - debian/patches/CVE-2025-1736.patch: updates the http user header check for crlf in ext/standard/http_fopen_wrapper.c - CVE-2025-1736 Important TuxCare License Agreement CVE-2025-1735 Ubuntu 20.04 LTS * SECURITY UPDATE: heap out-of-bounds write in BlobStream (WriteBlob) - debian/patches/CVE-2025-57807.patch: enforce extent ≥ offset + length when forward-seeking before writes in MagickCore/blob.c - CVE-2025-57807 Critical TuxCare License Agreement CVE-2025-57807 CVE-2025-53101 Ubuntu 20.04 LTS * SECURITY UPDATE: unsafe magnified size calculations leading to memory corruption - debian/patches/CVE-2025-55154.patch: Fix integer overflow in PNG image magnification causing memory corruption - CVE-2025-55154 Important TuxCare License Agreement CVE-2025-55154 Ubuntu 20.04 LTS * SECURITY UPDATE: improper return value handling in key derivation function - debian/patches/CVE-2025-5372.patch: reformat ssh_kdf() to fix formatting issue with EVP_KDF_ctrl calls - debian/patches/CVE-2025-5372-1.patch: simplify error checking and handling of return codes in ssh_kdf - CVE-2025-5372 Important TuxCare License Agreement CVE-2025-5372 Ubuntu 20.04 LTS * SECURITY UPDATE: format string bug vulnerability in InterpretImageFilename function - debian/patches/CVE-2025-55298.patch: Fix PercentNInvalidOperation and IsValidFormatSpecifier to handle invalid arguments in InterpretImageFilename - CVE-2025-55298 Important TuxCare License Agreement CVE-2025-55298 Ubuntu 20.04 LTS * SECURITY UPDATE: integer Overflow in BMP Encoder - debian/patches/CVE-2025-57803.patch: Fix buffer overflow issue in BMP decoder caused by insufficient memory allocation - CVE-2025-57803 Important TuxCare License Agreement CVE-2025-57803 Ubuntu 20.04 LTS * SECURITY UPDATE: crash triggered by passing a colon to montage -geometry - debian/patches/CVE-2025-55212.patch: Fix invalid height and width checks in ThumbnailImage using MagickSafeReciprocal - CVE-2025-55212 Important TuxCare License Agreement CVE-2025-55212 CVE-2025-53019 Ubuntu 20.04 LTS * SECURITY UPDATE: uncontrolled recursion leading to stack overflow via crafted XPath expressions - debian/patches/CVE-2025-9714.patch: Make XPath depth check work with recursive invocations to prevent stack overflows - CVE-2025-9714 Moderate TuxCare License Agreement CVE-2025-9714 Ubuntu 20.04 LTS * CVE-url: https://ubuntu.com/security/CVE-2022-43945 - NFSD: Protect against send buffer overflow in NFSv3 READ * CVE-url: https://ubuntu.com/security/CVE-2025-21796 - nfsd: clear acl_access/acl_default after releasing them * CVE-url: https://ubuntu.com/security/CVE-2022-48827 - NFSD: Fix the behavior of READ near OFFSET_MAX * CVE-url: https://ubuntu.com/security/CVE-2025-38477 - net/sched: sch_qfq: Fix race condition on qfq_aggregate - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class * CVE-url: https://ubuntu.com/security/CVE-2025-38618 - vsock: Do not allow binding to VMADDR_PORT_ANY * CVE-url: https://ubuntu.com/security/CVE-2025-38617 - net/packet: fix a race in packet_set_ring() and packet_notifier() * CVE-url: https://ubuntu.com/security/CVE-2021-47391 - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests * CVE-url: https://ubuntu.com/security/CVE-2024-41069 - ASoC: topology: Fix references to freed memory - ASoC: topology: Do not assign fields that are already set - ASoC: topology: Clean up route loading * CVE-url: https://ubuntu.com/security/CVE-2024-56616 - drm/dp_mst: Fix MST sideband message body length check * CVE-url: https://ubuntu.com/security/CVE-2024-35932 - drm/vc4: don't check if plane->state->fb == state->fb * CVE-url: https://ubuntu.com/security/CVE-2025-38350 - net/sched: Always pass notifications when child class becomes empty Important TuxCare License Agreement CVE-2025-21796 CVE-2025-38618 CVE-2025-38617 CVE-2025-38477 CVE-2025-38350 CVE-2024-56616 CVE-2024-41069 CVE-2024-35932 CVE-2022-48827 CVE-2022-43945 CVE-2021-47391 Ubuntu 20.04 LTS * SECURITY UPDATE: information disclosure vulnerability in error handling - debian/patches/CVE-2025-62168.patch: Fix HttpRequest::pack function to handle sensitive data by including a parameter for masking sensitive information - CVE-2025-62168 Important TuxCare License Agreement CVE-2025-62168 Ubuntu 20.04 LTS * CVE-url: https://ubuntu.com/security/CVE-2025-38352 - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() * CVE-url: https://ubuntu.com/security/CVE-2022-25265 - x86/elf: Add table to document READ_IMPLIES_EXEC - x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK - x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit * CVE-url: https://ubuntu.com/security/CVE-2022-49170 - f2fs: fix to do sanity check on curseg->alloc_type * CVE-url: https://ubuntu.com/security/CVE-2021-47479 - staging: rtl8712: fix use-after-free in rtl8712_dl_fw * CVE-url: https://ubuntu.com/security/CVE-2022-49519 - ath10k: skip ath10k_halt during suspend for driver state RESTARTING * CVE-url: https://ubuntu.com/security/CVE-2024-46713 - perf/aux: Fix AUX buffer serialization * CVE-url: https://ubuntu.com/security/CVE-2024-36914 - drm/amd/display: Skip on writeback when it's not applicable * CVE-url: https://ubuntu.com/security/CVE-2024-36880 - Bluetooth: qca: add missing firmware sanity checks * Miscellaneous upstream changes - net: openvswitch: fix nested key length validation in the set() action - isofs: Prevent the use of too small fid - ext4: ignore xattrs past end - net: ppp: Add bound checking for skb data on ppp_sync_txmung - media: venus: hfi: add check to handle incorrect queue size - media: venus: hfi_parser: add check to avoid out of bound access - sctp: detect and prevent references to a freed transport in sendmsg - ext4: improve xattr consistency checking and error reporting - ext4: introduce ITAIL helper - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - ibmvnic: create send_control_ip_offload - ibmvnic: Use strscpy() instead of strncpy() - ibmvnic: Use kernel helpers for hex dumps - wifi: at76c50x: fix use after free access in at76_disconnect - wifi: cfg80211: fix use-after-free in cmp_bss() Important TuxCare License Agreement CVE-2022-49519 CVE-2022-49170 CVE-2025-38352 CVE-2024-46713 CVE-2024-36914 CVE-2024-36880 CVE-2022-25265 CVE-2021-47479 Ubuntu 20.04 LTS * SECURITY UPDATE: integer overflow vulnerability in BMP decoder on 32-bit systems - debian/patches/CVE-2025-62171.patch: add extra check to resolve issue on 32-bit systems - CVE-2025-62171 Important TuxCare License Agreement CVE-2025-62171 Ubuntu 20.04 LTS * SECURITY UPDATE: out-of-bounds read via vfinfo function in ldmisc.c (CVE-16357) - debian/patches/CVE-2025-11840.patch: Prevent a NULL name for reloc howto at ld misc.c:527 to avoid a SEGV - CVE-2025-11840 Moderate TuxCare License Agreement CVE-2025-11840 Ubuntu 20.04 LTS * SECURITY UPDATE: Heap buffer overflow in array_merge() - debian/patches/CVE-2025-14178.patch: add validation to check if total element count exceeds HT_MAX_SIZE before allocation. - CVE-2025-14178 Low TuxCare License Agreement CVE-2025-14178 Ubuntu 20.04 LTS * SECURITY UPDATE: crash in objdump when processing malformed debug data - debian/patches/CVE-2025-11839.patch: remove abort() call in DGB debug-format printing code to avoid uncontrolled program termination when handling crafted input files - CVE-2025-11839 Important TuxCare License Agreement CVE-2025-1181 CVE-2025-3198 CVE-2025-7545 CVE-2025-11839 Ubuntu 20.04 LTS * SECURITY UPDATE: Heap-based buffer overflow in elf_swap_shdr function - debian/patches/CVE-2025-11083.patch: Don't swap in nor match corrupt section header in linker input to avoid linker crash. Changed elf_swap_shdr_in to return bfd_boolean and reject corrupt section headers in linker input files. - CVE-2025-11083 Important TuxCare License Agreement CVE-2025-11083 Ubuntu 20.04 LTS * SECURITY UPDATE: Possible memory corruption in the armor parser - debian/patches/CVE-2025-68973.patch: fix faulty double increment - CVE-2025-68973 Important TuxCare License Agreement CVE-2025-68973 Ubuntu 20.04 LTS * SECURITY UPDATE: debug_information memory leak in process_debug_info - debian/patches/CVE-2025-8225.patch: prevent memory leak by checking alloc_num_debug_info_entries instead of num_debug_info_entries to determine whether debug_information has been allocated - CVE-2025-8225 Low TuxCare License Agreement CVE-2025-8225 Ubuntu 20.04 LTS * SECURITY UPDATE: cupsd DoS via slow client connections - debian/patches/CVE-2025-58436.patch: implement non-blocking I/O and connection timeouts to prevent slow clients from blocking cupsd. - CVE-2025-58436 Moderate TuxCare License Agreement CVE-2025-58436 Ubuntu 20.04 LTS * SECURITY UPDATE: XML_ExternalEntityParserCreate does not copy unknown encoding handler user data - debian/patches/CVE-2026-24515.patch: Fix a null pointer dereference in the XML parser caused by the failure to copy user data for unknown encoding handlers - CVE-2026-24515 Critical TuxCare License Agreement CVE-2026-24515 Ubuntu 20.04 LTS * SECURITY UPDATE: reinstate alignment overflow - debian/patches/CVE-2026-0861.patch: Fix alignment overflow check regression in _int_memalign caused by the PTRDIFF_MAX size cap change - CVE-2026-0861 Important TuxCare License Agreement CVE-2026-0861 Ubuntu 20.04 LTS * SECURITY UPDATE: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files - debian/patches/CVE-2025-69421.patch: fix NULL pointer dereference in PKCS12_item_decrypt_d2i by adding NULL check for oct parameter - CVE-2025-69421 Important TuxCare License Agreement CVE-2025-69419 CVE-2025-69421 CVE-2025-69418 CVE-2026-22796 Ubuntu 20.04 LTS * SECURITY UPDATE: out of bounds write vulnerability in XBM decoder - debian/patches/CVE-2026-23876.patch: add overflow checks to prevent out of bounds write in coders/xbm.c - CVE-2026-23876 Critical TuxCare License Agreement CVE-2026-23876 Ubuntu 20.04 LTS * SECURITY UPDATE: stack overflow via deeply nested MSL/SVG elements - debian/patches/CVE-2025-68168.patch: add recursion depth checking in MSLStartElement and SVGStartElement to prevent stack exhaustion - CVE-2025-68168 * SECURITY UPDATE: integer overflow in SVG PathPrimitive processing - debian/patches/CVE-2025-69204.patch: add overflow checks for number_attributes calculation in WriteSVGImage PathPrimitive case - CVE-2025-69204 Important TuxCare License Agreement CVE-2025-69204 CVE-2025-68618 Ubuntu 20.04 LTS * SECURITY UPDATE: Heap-based buffer overflow - debian/patches/CVE-2025-13601.patch: Fix heap-based buffer overflow by correcting buffer size calculation in g_escape_uri_string() - CVE-2025-13601 Important TuxCare License Agreement CVE-2025-13601 Ubuntu 20.04 LTS * SECURITY UPDATE: Buffer underflow in GVariant parser leads to heap corruption - debian/patches/CVE-2025-14087.patch: Fix integer overflows in GVariant text format parser when processing input longer than INT_MAX, and fix integer overflow in escape_byte_string() for byte strings with many invalid characters - CVE-2025-14087 Critical TuxCare License Agreement CVE-2025-14087 Ubuntu 20.04 LTS * OpenJDK 8u482 release, build 8. Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html - Security fixes (8u482): + CVE-2026-21945: Prevent DoS via repeated crash or hang in sandbox security + CVE-2026-21932: Fix integrity issue in sandboxed handling of untrusted input + CVE-2026-21933: Prevent unauthorized data access or modification via networking APIs + CVE-2026-21925: Fix RMI flaw allowing unauthorized data read or modification - Previously fixed: * 8u472: - CVE-2025-53066: Prevent DoS or data exposure from untrusted input handling - CVE-2025-53057: Fix validation flaw affecting sandboxed networking/security logic - CVE-2025-61748: Prevent resource-consumption denial-of-service via crafted input * 8u462: - CVE-2025-30749: Fix security flaw enabling unauthorized actions or data exposure - CVE-2025-30754: Correct validation weakness affecting sandboxed execution integrity - CVE-2025-30761: Prevent unintended data access or via insufficient checks - CVE-2025-50106: Fix parsing weakness leading to potential denial-of-service - CVE-2025-50059: Fix improper HTTP header handling to prevent unintended requests Important TuxCare License Agreement CVE-2026-21925 CVE-2026-21933 CVE-2026-21945 CVE-2026-21932 Ubuntu 20.04 LTS * SECURITY UPDATE: security vulnerability (CVE-2026-25897) - debian/patches/CVE-2026-25897.patch: prevent integer overflow during pixel buffer size calculation by using checked multiplication and validating rows addition; issue caused by unvalidated header values allowing overflow and incorrect allocation size - CVE-2026-25897 * SECURITY UPDATE: security vulnerability (CVE-2026-26284) - debian/patches/CVE-2026-26284.patch: prevent out-of-bounds read while searching PCD decode table by starting iteration at first valid element; issue caused by loop beginning at index 0 and incrementing pointer past the table end when no sequence matched - CVE-2026-26284 Critical TuxCare License Agreement CVE-2026-25897 CVE-2026-26284 Ubuntu 20.04 LTS * SECURITY UPDATE: integer overflow in pixel cache allocation - debian/patches/CVE-2026-25798.patch: add CacheOverflowSanityCheckGetSize to detect overflow in number_pixels*packet_size in OpenPixelCache - CVE-2026-25798 * SECURITY UPDATE: infinite loop in IPTC metadata processing - debian/patches/CVE-2026-26066.patch: fix infinite loop in formatIPTC by reading next byte instead of resetting to zero - CVE-2026-26066 * SECURITY UPDATE: division by zero in YUV sampling factor validation - debian/patches/CVE-2026-25799.patch: fix sampling factor check in ReadYUVImage and WriteYUVImage to reject invalid individual factors - CVE-2026-25799 Important TuxCare License Agreement CVE-2026-25799 CVE-2026-25798 CVE-2026-26066 Ubuntu 20.04 LTS * SECURITY UPDATE: memory leak in ReadSTEGANOImage that can be exploited for denial-of-service - debian/patches/CVE-2026-25796.patch: free watermark object on three early-return paths - CVE-2026-25796 Important TuxCare License Agreement CVE-2026-25796 Ubuntu 20.04 LTS * CVE-2025-38699 - scsi: bfa: Double-free fix {CVE-2025-38699} * CVE-2025-38697 - jfs: upper bound check of tree index in dbAllocAG {CVE-2025-38697} * CVE-2025-39823 - KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823} * CVE-2025-39689 - ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689} * CVE-2025-39749 - rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749} * CVE-2025-38728 - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728} * CVE-2025-38676 - iommu/amd: Avoid stack buffer overflow from kernel cmdline {CVE-2025-38676} * CVE-2025-38574 - pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574} * CVE-2025-38572 - ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572} * CVE-2025-38685 - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685} * CVE-2025-38563 - vm_ops: rename .split() callback to .may_split() {CVE-2025-38563} - perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563} * CVE-2025-38702 - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702} * CVE-2025-39911 - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911} * CVE-2025-39971 - i40e: fix idx validation in config queues msg {CVE-2025-39971} * CVE-2025-40154 - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154} * CVE-2025-39973 - i40e: increase max descriptors for XL710 {CVE-2025-39973} - i40e: add validation for ring_len param {CVE-2025-39973} * CVE-2022-49026 - e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026} * CVE-2025-38724 - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724} * CVE-2025-39853 - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853} * CVE-2025-39860 - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860} * CVE-2025-39891 - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891} * CVE-2025-38530 - comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530} * CVE-2025-38529 - comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529} * CVE-2025-38497 - usb: gadget: configfs: Fix OOB read on empty string write {CVE-2025-38497} * CVE-2025-38483 - comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483} * CVE-2025-38482 - comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482} * CVE-2025-39702 - ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702} * CVE-2025-39730 - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730} * CVE-2025-39841 - scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841} * CVE-2025-39817 - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} * CVE-2025-38494 - HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38494} - HID: core: ensure __hid_request reserves the report ID as the first byte {CVE-2025-38494} - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494} * CVE-2025-39757 - ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} * CVE-2025-38527 - smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} * CVE-2023-52854 - padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854} * CVE-2024-35867 - smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867} * CVE-2024-50061 - i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition {CVE-2024-50061} * CVE-2025-39965 - xfrm: Duplicate SPI Handling {CVE-2025-39965} * CVE-2025-22107 - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() {CVE-2025-22107} * CVE-2025-37928 - dm-bufio: don't schedule in atomic context {CVE-2025-37928} * CVE-2025-37927 - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927} * CVE-2025-37915 - net_sched: drr: Fix double list add in class with netem as child qdisc {CVE-2025-37915} * CVE-2025-37913 - net_sched: qfq: Fix double list add in class with netem as child qdisc {CVE-2025-37913} * CVE-2025-37817 - mcb: fix a double free bug in chameleon_parse_gdd() {CVE-2025-37817} * CVE-2025-38204 - jfs: fix array-index-out-of-bounds read in add_missing_indices {CVE-2025-38204} * CVE-2025-38323 - net: atm: add lec_mutex {CVE-2025-38323} * CVE-2025-38346 - ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346} * CVE-2025-38348 - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() {CVE-2025-38348} * CVE-2025-38415 - Squashfs: check return result of sb_min_blocksize {CVE-2025-38415} * CVE-2025-38416 - NFC: nci: uart: Set tty->disc_data only in success path {CVE-2025-38416} * CVE-2025-38428 - Input: ims-pcu - check record size in ims_pcu_flash_firmware() {CVE-2025-38428} * CVE-2025-38102 - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102} * CVE-2025-38245 - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245} * CVE-2025-38249 - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249} * CVE-2025-38377 - rose: fix dangling neighbour pointers in rose_rt_device_down() {CVE-2025-38377} * CVE-2025-38389 - drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389} * CVE-2025-38395 - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395} * CVE-2025-38401 - mtk-sd: Prevent memory corruption from DMA map failure {CVE-2025-38401} * CVE-2025-38445 - md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445} * CVE-2025-38459 - atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459} * CVE-2025-39863 - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863} * CVE-2025-38068 - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} * CVE-2025-21726 - padata: avoid UAF for reorder_work {CVE-2025-21726} * CVE-2025-39760 - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} * CVE-2022-49698 - netfilter: use get_random_u32 instead of prandom {CVE-2022-49698} * CVE-2025-38198 - fbcon: Introduce wrapper for console->fb_info lookup {CVE-2025-38198} - fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198} * CVE-2025-38422 - net: lan743x: Add support for 4 Tx queues {CVE-2025-38422} - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices {CVE-2025-38422} - net: lan743x: Add PCI11010 / PCI11414 device IDs {CVE-2025-38422} * CVE-2025-38375 - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375} * CVE-2025-39901 - i40e: remove read access to debugfs files {CVE-2025-39901} * CVE-2025-39810 - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810} * CVE-2025-39905 - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905} * CVE-2025-39993 - media: imon: reorganize serialization {CVE-2025-39993} - media: rc: fix races with imon_disconnect() {CVE-2025-39993} * CVE-2025-39883 - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883} * Miscellaneous upstream changes - net: atm: fix /proc/net/atm/lec handling {CVE-2025-38323} Important TuxCare License Agreement CVE-2025-38348 CVE-2025-38572 CVE-2025-38563 CVE-2025-39730 CVE-2025-39689 CVE-2025-38377 CVE-2025-39749 CVE-2025-39823 CVE-2025-39911 CVE-2025-39797 CVE-2024-50061 CVE-2025-38676 CVE-2024-35867 CVE-2025-38728 CVE-2025-21727 CVE-2025-39901 CVE-2025-21726 CVE-2025-39883 CVE-2025-37915 CVE-2025-38497 CVE-2025-38389 CVE-2025-38415 CVE-2025-39905 CVE-2025-37879 CVE-2025-40154 CVE-2025-37927 CVE-2025-39841 CVE-2025-38069 CVE-2022-49698 CVE-2025-38718 CVE-2025-39757 CVE-2022-49026 CVE-2022-49975 CVE-2025-39751 CVE-2025-39702 CVE-2025-38527 CVE-2025-39853 CVE-2023-53282 CVE-2025-37839 CVE-2025-39973 CVE-2025-37823 CVE-2025-38346 CVE-2025-39965 CVE-2025-38323 CVE-2022-49980 CVE-2025-38422 CVE-2025-39817 CVE-2025-37882 CVE-2025-38702 CVE-2025-39860 CVE-2025-38529 CVE-2025-38445 CVE-2025-37817 CVE-2025-37913 CVE-2025-38697 CVE-2025-37892 CVE-2025-38574 CVE-2025-38102 CVE-2025-38459 CVE-2025-37923 CVE-2025-38724 CVE-2025-22107 CVE-2025-38494 CVE-2025-38395 CVE-2025-39863 CVE-2025-38699 CVE-2025-38428 CVE-2025-38482 CVE-2025-38245 CVE-2025-38530 CVE-2025-39971 CVE-2025-38483 CVE-2025-37928 CVE-2025-38204 CVE-2025-39810 CVE-2023-52854 CVE-2025-38068 CVE-2025-38198 CVE-2025-38685 CVE-2025-38375 CVE-2025-38250 CVE-2022-21546 CVE-2025-38556 CVE-2025-39760 CVE-2025-38401 CVE-2025-39993 CVE-2025-37810 CVE-2025-38416 CVE-2025-38249 CVE-2024-56664 CVE-2025-22083 CVE-2025-39891 CVE-2025-37739 Ubuntu 20.04 LTS * SECURITY UPDATE: OAuth2 bearer token leak on cross-protocol redirect - debian/patches/CVE-2025-14524.patch: do not use bearer when following redirect unless allow_auth_to_other_hosts is set - CVE-2025-14524 * SECURITY UPDATE: libssh global known_hosts override - debian/patches/CVE-2025-15079-CVE-2025-15224.patch: set SSH_OPTIONS_GLOBAL_KNOWNHOSTS to same path as SSH_OPTIONS_KNOWNHOSTS - CVE-2025-15079 * SECURITY UPDATE: libssh key passphrase bypass without agent set - debian/patches/CVE-2025-15079-CVE-2025-15224.patch: require private key or CURLSSH_AUTH_AGENT for public key auth - CVE-2025-15224 Low TuxCare License Agreement CVE-2025-15224 CVE-2025-14524 CVE-2025-15079 Ubuntu 20.04 LTS * SECURITY UPDATE: heap information disclosure in PSD channel decoder - debian/patches/CVE-2026-24481.patch: initialize pixel buffer with zeros in ReadPSDChannelZip to prevent heap memory leak - CVE-2026-24481 Low TuxCare License Agreement CVE-2026-24481 Ubuntu 20.04 LTS * SECURITY UPDATE: unauthenticated command injection via WINS hook in source4 NBT server. The "wins hook" parameter passed unsanitized NetBIOS names to a shell command, allowing arbitrary command execution by remote clients. - debian/patches/CVE-2025-10230.patch - CVE-2025-10230 Critical TuxCare License Agreement CVE-2025-10230 Ubuntu 20.04 LTS * SECURITY UPDATE: null pointer dereference and crash during image reading - debian/patches/CVE-2026-25795.patch: Fix NULL pointer dereference by reordering DestroyImageInfo after copy of filename; cause: Free read_info before access of read_info->filename - CVE-2026-25795 Important TuxCare License Agreement CVE-2026-25795 Ubuntu 20.04 LTS * SECURITY UPDATE: Unauthenticated heap memory disclosure via mismatched zlib compressed protocol headers (MongoBleed) - debian/patches/CVE-2025-14847.patch: Return actual decompressed size instead of buffer size in ZlibMessageCompressor::decompressData - CVE-2025-14847 Low TuxCare License Agreement CVE-2025-14847 Ubuntu 20.04 LTS * SECURITY UPDATE: stack buffer overflow in MSL opacity attribute parser - debian/patches/CVE-2026-25968.patch: replace fixed-size stack buffer with heap-allocated string and add length check - CVE-2026-25968 * SECURITY UPDATE: heap buffer overflow write in YUV 4:2:2 image processing - debian/patches/CVE-2026-25986.patch: fix off-by-one in pixel-pair loop bound in ReadYUVImage and WriteYUVImage - CVE-2026-25986 * SECURITY UPDATE: heap buffer over-read in MAP image decoder - debian/patches/CVE-2026-25987.patch: validate colormap size against depth before buffer allocation - CVE-2026-25987 Critical TuxCare License Agreement CVE-2026-25986 CVE-2026-25968 CVE-2026-25987 Ubuntu 20.04 LTS * SECURITY UPDATE: SNI validation issue in mod_ssl - debian/patches/CVE-2025-23048.patch: update SNI validation to move the SSL compatibility check after strict SNI hostname verification in modules/ssl/ssl_engine_kernel.c. - CVE-2025-23048 Important TuxCare License Agreement CVE-2025-23048 Ubuntu 20.04 LTS * SECURITY UPDATE: Improper Input Validation vulnerability - debian/patches/CVE-2025-66614.patch: Add protocol host name and SNI host name matching with strictSNI attribute on the Connector. Covers NIO, NIO2, and APR connectors. - CVE-2025-66614 Critical TuxCare License Agreement CVE-2025-66614 Ubuntu 20.04 LTS * SECURITY UPDATE: out-of-bounds read in sftp extension name handler - debian/patches/CVE-2026-3731.patch: fix off-by-one bounds check in sftp_extensions_get_name and sftp_extensions_get_data - CVE-2026-3731 Important TuxCare License Agreement CVE-2026-3731 Ubuntu 20.04 LTS * SECURITY UPDATE: integer overflow in doContent tag buffer reallocation. - debian/patches/CVE-2026-25210.patch: add overflow check for tag buffer reallocation - CVE-2026-25210 Important TuxCare License Agreement CVE-2026-25210 Ubuntu 20.04 LTS * SECURITY UPDATE: out-of-bound read with negative pixel index in UIL and XPM encoders - debian/patches/CVE-2026-25898.patch: add bounds check on pixel index value returned by GetPixelIndex before using as array subscript - CVE-2026-25898 * SECURITY UPDATE: heap use-after-free in MSL repage and roll handlers - debian/patches/CVE-2026-25983.patch: move null check before accessing image properties in repage and roll element handlers - CVE-2026-25983 * SECURITY UPDATE: stack overflow via infinite recursion in MSL write handler - debian/patches/CVE-2026-25971.patch: check output format before calling WriteImage to prevent recursive MSL processing - CVE-2026-25971 Critical TuxCare License Agreement CVE-2026-25971 CVE-2026-25983 CVE-2026-25898 Ubuntu 20.04 LTS * SECURITY UPDATE: heap buffer over-read with wavelet-denoise operator - debian/patches/CVE-2026-27798.patch: use 4*columns instead of 3*columns for resource and memory allocation in WaveletDenoiseImage to prevent over-read when processing small-dimension images - CVE-2026-27798 Important TuxCare License Agreement CVE-2026-27798 Ubuntu 20.04 LTS * SECURITY UPDATE: heap over-write in PNG raw profile writer - debian/patches/CVE-2026-30883.patch: add overflow check for allocated_length in Magick_png_write_raw_profile to prevent integer overflow leading to heap over-write - CVE-2026-30883 Important TuxCare License Agreement CVE-2026-30883 Ubuntu 20.04 LTS * SECURITY UPDATE: local file disclosure through path traversal bypass of path security policy - debian/patches/CVE-2026-25965.patch: Resolve and canonicalize file paths before policy pattern matching; prevent path traversal by fixing policy checks that matched unnormalized paths (including symlinks and '../') allowing bypass. - CVE-2026-25965 Important TuxCare License Agreement CVE-2026-25965 Ubuntu 20.04 LTS * SECURITY UPDATE: NULL pointer dereference in MSL parser - debian/patches/CVE-2026-23952.patch: add NULL check for image before DeleteImageProperty in comment and label tag handlers - CVE-2026-23952 * SECURITY UPDATE: memory leak in MSL parser - debian/patches/CVE-2026-25988.patch: return stack index from MSLPushImage to ensure correct image slot tracking - CVE-2026-25988 * SECURITY UPDATE: signed integer overflow in SIXEL decoder - debian/patches/CVE-2026-25970.patch: use ssize_t for position and offset variables to prevent integer overflow in sixel_decode - CVE-2026-25970 Important TuxCare License Agreement CVE-2026-25970 CVE-2026-23952 CVE-2026-25988 Ubuntu 20.04 LTS * SECURITY UPDATE: pre-auth crash via GSSAPI key exchange - debian/patches/CVE-2026-3497.patch: replace sshpkt_disconnect() with ssh_packet_disconnect() and initialize gss_buffer_desc variables in kexgssc.c, kexgsss.c. - CVE-2026-3497 Important TuxCare License Agreement CVE-2026-3497 Ubuntu 20.04 LTS * CVE-2025-39683 - tracing: Remove unneeded goto out logic {CVE-2025-39683} - tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683} * CVE-2025-38079 - crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079} * CVE-2025-38159 - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159} * CVE-2025-38211 - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211} * CVE-2025-38024 - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024} * CVE-2025-38103 - HID: hyperv: Correctly access fields declared as __le16 {CVE-2025-38103} - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103} * CVE-2025-38157 - wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157} * CVE-2025-38230 - jfs: add sanity check for agwidth in dbMount {CVE-2025-38230} - fs/jfs: consolidate sanity checking in dbMount {CVE-2025-38230} - jfs: validate AG parameters in dbMount() to prevent crashes {CVE-2025-38230} * CVE-2025-39955 - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955} * CVE-2025-38680 - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680} * CVE-2025-38708 - drbd: add missing kref_get in handle_write_conflicts {CVE-2025-38708} * CVE-2025-39759 - btrfs: qgroup: introduce quota mode {CVE-2025-39759} - btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759} * CVE-2025-38666 - net: appletalk: Fix use-after-free in AARP proxy probe {CVE-2025-38666} * CVE-2025-40269 - ALSA: usb-audio: Improve frames size computation {CVE-2025-40269} - ALSA: usb-audio: Replace s/frame/packet/ where appropriate {CVE-2025-40269} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269} * CVE-2025-40149 - net: netdevice: Add operation ndo_sk_get_lower_dev {CVE-2025-40149} - net/tls: Device offload to use lowest netdevice in chain {CVE-2025-40149} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149} * CVE-2025-71089 - iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089} * CVE-2026-23234 - f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234} * CVE-2026-23089 - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089} * CVE-2026-23074 - net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074} * CVE-2026-23061 - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061} * CVE-2026-23060 - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060} * CVE-2026-22997 - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997} * CVE-2026-22991 - libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991} * CVE-2026-22990 - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() {CVE-2026-22990} * CVE-2026-22978 - wifi: avoid kernel-infoleak from struct iw_point {CVE-2026-22978} * CVE-2026-22977 - net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977} * CVE-2025-71154 - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154} * CVE-2025-71085 - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085} * CVE-2025-68734 - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() {CVE-2025-68734} * CVE-2025-68349 - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349} * CVE-2025-68340 - team: Move team device type change at the end of team_port_add {CVE-2025-68340} * CVE-2025-68325 - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop {CVE-2025-68325} * CVE-2025-68287 - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths {CVE-2025-68287} * CVE-2025-68285 - libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285} * CVE-2025-68241 - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe {CVE-2025-68241} * CVE-2025-68229 - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() {CVE-2025-68229} * CVE-2025-68220 - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error {CVE-2025-68220} * CVE-2025-68194 - media: imon: make send_packet() more robust {CVE-2025-68194} * CVE-2025-68192 - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192} * CVE-2025-68185 - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing {CVE-2025-68185} * CVE-2025-68168 - jfs: fix uninitialized waitqueue in transaction manager {CVE-2025-68168} * CVE-2025-40363 - net: ipv6: fix field-spanning memcpy warning in AH output {CVE-2025-40363} * CVE-2025-40331 - sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331} * CVE-2025-40322 - fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322} * CVE-2025-40317 - regmap: slimbus: fix bus_context pointer in regmap init calls {CVE-2025-40317} * CVE-2025-40315 - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. {CVE-2025-40315} * CVE-2025-40309 - Bluetooth: SCO: Fix UAF on sco_conn_free {CVE-2025-40309} * CVE-2025-40308 - Bluetooth: bcsp: receive data only if registered {CVE-2025-40308} * CVE-2025-40306 - orangefs: fix xattr related buffer overflow... {CVE-2025-40306} * CVE-2025-40304 - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304} * CVE-2025-40283 - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF {CVE-2025-40283} * CVE-2025-40282 - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path {CVE-2025-40282} * CVE-2025-40277 - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277} * CVE-2025-40275 - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275} * CVE-2025-40264 - be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264} * CVE-2025-40263 - Input: cros_ec_keyb - fix an invalid memory access {CVE-2025-40263} * CVE-2025-40259 - scsi: sg: Do not sleep in atomic context {CVE-2025-40259} * CVE-2025-40254 - net: openvswitch: remove never-working support for setting nsh fields {CVE-2025-40254} * CVE-2025-40248 - vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248} * CVE-2025-40211 - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() {CVE-2025-40211} * CVE-2025-40106 - comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106} * CVE-2025-40087 - NFSD: Define a proc_layoutcommit for the FlexFiles layout type {CVE-2025-40087} * CVE-2025-40055 - ocfs2: fix double free in user_cluster_connect() {CVE-2025-40055} * CVE-2025-39945 - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945} * CVE-2025-39738 - btrfs: do proper error handling in create_reloc_root {CVE-2025-39738} - btrfs: do not allow relocation of partially dropped subvolumes {CVE-2025-39738} * CVE-2025-39685 - comedi: pcl726: Prevent invalid irq number {CVE-2025-39685} * CVE-2024-46830 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS {CVE-2024-46830} * CVE-2024-41014 - xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014} * CVE-2025-39866 - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866} * CVE-2025-39686 - comedi: Fix some signed shift left operations {CVE-2025-39686} - comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686} * CVE-2025-39766 - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766} * CVE-2025-39828 - net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2025-39828} - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-39828} - atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-39828} - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). {CVE-2025-39828} * CVE-2022-49267 - mmc: core: Do not export MMC_NAME= and MODALIAS=mmc:block for SDIO cards {CVE-2022-49267} - mmc: core: Export device/vendor ids from Common CIS for SDIO cards {CVE-2022-49267} - mmc: sdio: Extend sdio_config_attr macro and use it also for modalias {CVE-2022-49267} - mmc: sdio: Export SDIO revision and info strings to userspace {CVE-2022-49267} - mmc: sdio: Parse CISTPL_VERS_1 major and minor revision numbers {CVE-2022-49267} - mmc: core: use sysfs_emit() instead of sprintf() {CVE-2022-49267} * CVE-2025-39967 - fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967} * CVE-2025-38108 - net_sched: red: fix a race in __red_change() {CVE-2025-38108} * CVE-2025-38212 - ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212} * CVE-2025-38403 - vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403} * CVE-2025-38464 - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464} * CVE-2025-38555 - usb: gadget : fix use-after-free in composite_dev_cleanup() {CVE-2025-38555} * CVE-2025-38652 - f2fs: fix to avoid out-of-boundary access in devs.path {CVE-2025-38652} * CVE-2025-38677 - f2fs: fix to avoid out-of-boundary access in dnode page {CVE-2025-38677} * CVE-2025-38713 - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() {CVE-2025-38713} * CVE-2025-38714 - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() {CVE-2025-38714} * CVE-2025-38715 - hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715} * CVE-2025-38729 - ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729} * CVE-2025-39691 - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691} * CVE-2025-39743 - jfs: truncate good inode pages when hard link is 0 {CVE-2025-39743} * CVE-2025-39783 - PCI: endpoint: Fix configfs group list head handling {CVE-2025-39783} * CVE-2025-39824 - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824} * CVE-2025-39839 - batman-adv: fix OOB read/write in network-coding decode {CVE-2025-39839} * CVE-2025-39913 - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913} * CVE-2025-40240 - sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240} * CVE-2025-38004 - can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004} * Miscellaneous upstream changes - wifi: wilc1000: avoid buffer overflow in WID string configuration {CVE-2025-39952} - Revert "dm-bufio: don't schedule in atomic context {CVE-2025-37928}" Important TuxCare License Agreement CVE-2025-40275 CVE-2025-40306 CVE-2025-40331 CVE-2025-68734 CVE-2025-40304 CVE-2025-40106 CVE-2026-23089 CVE-2025-39866 CVE-2025-38108 CVE-2025-68168 CVE-2025-71085 CVE-2025-40363 CVE-2025-39686 CVE-2025-39955 CVE-2025-68241 CVE-2025-38555 CVE-2025-38159 CVE-2025-39952 CVE-2025-39759 CVE-2025-40269 CVE-2025-38079 CVE-2025-39743 CVE-2025-40087 CVE-2022-49267 CVE-2025-38713 CVE-2025-40322 CVE-2025-40264 CVE-2026-22997 CVE-2024-41014 CVE-2025-40317 CVE-2025-38729 CVE-2025-68287 CVE-2025-39967 CVE-2025-68285 CVE-2025-40211 CVE-2025-68185 CVE-2025-39683 CVE-2025-38464 CVE-2025-39685 CVE-2025-40259 CVE-2025-38103 CVE-2025-68194 CVE-2025-40309 CVE-2025-40055 CVE-2026-22978 CVE-2025-39839 CVE-2026-23074 CVE-2026-23234 CVE-2025-38157 CVE-2026-22990 CVE-2025-38708 CVE-2025-39824 CVE-2025-39913 CVE-2025-68220 CVE-2025-39945 CVE-2025-40263 CVE-2025-39828 CVE-2025-39738 CVE-2025-68325 CVE-2025-38230 CVE-2025-68229 CVE-2025-40315 CVE-2025-38403 CVE-2025-40283 CVE-2025-38652 CVE-2025-68192 CVE-2025-40254 CVE-2025-39783 CVE-2025-39691 CVE-2026-22977 CVE-2025-38211 CVE-2025-40248 CVE-2025-38666 CVE-2025-38680 CVE-2026-23061 CVE-2025-40277 CVE-2024-46830 CVE-2025-38715 CVE-2025-38677 CVE-2026-22991 CVE-2025-40282 CVE-2026-23060 CVE-2025-38714 CVE-2025-40308 CVE-2025-38024 CVE-2025-38004 CVE-2025-71154 CVE-2025-71089 CVE-2025-40149 CVE-2025-68340 CVE-2025-68349 CVE-2025-39766 CVE-2025-38212 CVE-2025-40240 Ubuntu 20.04 LTS * SECURITY UPDATE: denial-of-service from multi-layer nested MVG-to-SVG conversions - debian/patches/CVE-2026-24484.patch: Add recursion-depth check and throw VectorGraphicsNestedTooDeeply on reaching maximum; prevent crash from unbounded nesting of graphic-context elements. - debian/patches/CVE-2026-24484-1.patch: Set status to MagickFalse on memory-allocation failure and on excessive recursion, stop further parsing; cause: missing status reset allowed continued parsing and nested vector-graphics recursion to exceed limits. - CVE-2026-24484 Moderate TuxCare License Agreement CVE-2026-24484 Ubuntu 20.04 LTS * SECURITY UPDATE: segfault in debug_type_samep on crafted input - debian/patches/CVE-2025-5245.patch: correct incomplete enum test in debug_type_samep and remove dead code in debug_write_type - CVE-2025-5245 * SECURITY UPDATE: segfault in ld on fuzzed object with empty group - debian/patches/CVE-2025-5244.patch: add NULL check for first section in elf_gc_sweep to protect against empty group - CVE-2025-5244 * SECURITY UPDATE: read beyond .eh_frame section size - debian/patches/CVE-2025-11082.patch: use memchr instead of strlen to avoid reading beyond .eh_frame section bounds in _bfd_elf_parse_eh_frame - CVE-2025-11082 Important TuxCare License Agreement CVE-2025-11082 CVE-2025-5244 CVE-2025-5245 Ubuntu 20.04 LTS * SECURITY UPDATE: denial of service via use-after-free in ICP - debian/patches/CVE-2026-33526.patch: remove duplicate rfc1738_escape call in icpGetRequest that invalidated the previously escaped URL pointer - CVE-2026-33526 * SECURITY UPDATE: denial of service via use-after-free in ICP request handling - debian/patches/CVE-2026-32748.patch: return HttpRequestPointer and move icpAccessAllowed into icpGetRequest to fix HttpRequest lifetime for ICP v3 queries - CVE-2026-32748 Important TuxCare License Agreement CVE-2026-33526 CVE-2026-32748 Ubuntu 20.04 LTS * CVE-2024-56640 - net/smc: fix LGR and link use-after-free issue {CVE-2024-56640} * CVE-2026-23209 - macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209} * CVE-2026-23193 - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193} * CVE-2026-23204 - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204} * CVE-2025-38153 - net: usb: aqc111: fix error handling of usbnet read calls {CVE-2025-38153} * CVE-2024-53218 - f2fs: fix race in concurrent f2fs_stop_gc_thread {CVE-2024-53218} * CVE-2025-38565 - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} * CVE-2025-38051 - smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051} * Miscellaneous upstream changes - PCI: endpoint: Fix configfs group removal on driver teardown - net: usb: aqc111: debug info before sanitation - net: add skb_header_pointer_careful() helper Important TuxCare License Agreement CVE-2025-38153 CVE-2026-23204 CVE-2025-38051 CVE-2024-53218 CVE-2024-56640 CVE-2025-38565 CVE-2026-23209 CVE-2026-23193 Ubuntu 20.04 LTS * SECURITY UPDATE: buffer overflow in xcoff linker - debian/patches/CVE-2026-3441_CVE-2026-3442.patch: properly bounds check XTY_LD x_scnlen index in xcoff_link_add_symbols - CVE-2026-3441 * SECURITY UPDATE: out-of-bounds read in xcoff linker - debian/patches/CVE-2026-3441_CVE-2026-3442.patch: sanity check r_symndx before using it to index sym hashes - CVE-2026-3442 Important TuxCare License Agreement CVE-2026-3442 CVE-2026-3441 Ubuntu 20.04 LTS * SECURITY UPDATE: null pointer dereference and out-of-bounds read in sftp_parse_longname when processing malformed SSH_FXP_NAME messages - debian/patches/CVE-2026-0968.patch: add null check, input validation, and end-of-string guards in sftp_parse_longname - CVE-2026-0968 Low TuxCare License Agreement CVE-2026-0968 Ubuntu 20.04 LTS * SECURITY UPDATE: heap buffer overflow in UTF-16 to UTF-8 conversion - debian/patches/CVE-2026-32636.patch: allocate (*length+1) instead of *length in ConvertUTF16ToUTF8() in magick/xml-tree.c to make room for the null terminator. - CVE-2026-32636 Important TuxCare License Agreement CVE-2026-32636 Ubuntu 20.04 LTS * SECURITY UPDATE: ANSI escape sequence injection via sideband - debian/patches/CVE-2024-52005.patch: add strbuf_add_sanitized() to mask control characters in sideband output in sideband.c. - CVE-2024-52005 Important TuxCare License Agreement CVE-2024-52005 Ubuntu 20.04 LTS * SECURITY UPDATE: quadratic re-parsing DoS with large tokens - debian/patches/CVE-2023-52425.patch: add callProcessor() wrapper with reparse deferral heuristic in expat/lib/xmlparse.c, add XML_SetReparseDeferralEnabled() API in expat/lib/expat.h. - CVE-2023-52425 Important TuxCare License Agreement CVE-2023-52425 Ubuntu 20.04 LTS * SECURITY UPDATE: heap buffer overflow in certtool template parsing - debian/patches/CVE-2025-32990.patch: use calloc(MAX_ENTRIES + 1) instead of malloc(MAX_ENTRIES) in READ_MULTI_LINE and READ_MULTI_LINE_TOKENIZED macros in src/certtool-cfg.c. - CVE-2025-32990 * SECURITY UPDATE: double free when exporting othernames in SAN - debian/patches/CVE-2025-32988.patch: remove erroneous asn1_delete_structure calls on non-owned ext parameter in _gnutls_write_new_othername in lib/x509/extensions.c. - CVE-2025-32988 Important TuxCare License Agreement CVE-2025-32990 CVE-2025-32988 Ubuntu 20.04 LTS * SECURITY UPDATE: DoS via unbounded request body in mod_lua - debian/patches/CVE-2022-29404-part1.patch: set AP_DEFAULT_LIMIT_REQ_BODY to 1GB in server/core.c, enforce LimitRequestBody in ap_setup_client_block() in modules/http/http_filters.c, remove redundant proxy check in modules/proxy/mod_proxy_http.c. - CVE-2022-29404 - Note: Part 2 (cast fix) was already applied. Important TuxCare License Agreement CVE-2022-29404 Ubuntu 20.04 LTS * SECURITY UPDATE: control-character injection in scheduler option handling - debian/patches/CVE-2026-34980.patch: filter control characters from IPP string option values and reject "special" PPD keywords (cupsFilter, cupsFilter2, etc.) reported back by job filters to prevent filter/command injection via crafted job options - CVE-2026-34980 Important TuxCare License Agreement CVE-2026-34980 Ubuntu 20.04 LTS * SECURITY UPDATE: integer truncation in VIFF encoder leading to out-of-bounds heap write - debian/patches/CVE-2026-33900.patch: add truncation check before AcquireVirtualMemory() call in WriteVIFFImage() in coders/viff.c - CVE-2026-33900 * SECURITY UPDATE: out-of-bounds read in SampleImage via sample:offset define - debian/patches/CVE-2026-33905.patch: rewrite SampleImage() in magick/resize.c to compute x_offset/y_offset per pixel and fetch a single virtual pixel instead of indexing a preallocated row buffer - CVE-2026-33905 Important TuxCare License Agreement CVE-2026-33900 CVE-2026-33905 Ubuntu 20.04 LTS * SECURITY UPDATE: mishandling of authorized_keys principals option - debian/patches/CVE-2026-35414.patch: replace match_list() with xstrdup + strsep + exact strcmp in match_principals_option() in auth2-pubkey.c, so certificate principals containing embedded commas are no longer wrongly cross-matched. - CVE-2026-35414 Important TuxCare License Agreement CVE-2026-35414 Ubuntu 20.04 LTS * SECURITY UPDATE: Denial of Service caused by unbounded TLS handshake wrap queue in SecureNio2Channel / SecureNioChannel. Backport upstream fix from 9.0.x commit 76c5cce6f0bcef14b0c21c38910371ca7d322d13. - debian/patches/CVE-2024-38286.patch: cap the handshake wrap queue at HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT (100) and close the connection with a localised error message if the cap is exceeded, covering both Nio2 and Nio connector variants. Also includes upstream follow-up bfa5de95ad ("Avoid possible lost update") which converts the SecureNio2Channel counter to AtomicInteger and resets it in reset() to prevent a non-atomic read-modify-write race. - CVE-2024-38286 Important TuxCare License Agreement CVE-2024-38286 Ubuntu 20.04 LTS * SECURITY UPDATE: Heap buffer over-read in png_write_image_* due to truncation of ptrdiff_t row stride to png_uint_16 - debian/patches/CVE-2026-22801.patch: remove incorrect truncation casts from png_write_image_16bit, png_write_image_8bit, and png_image_write_main so large (>65535) and negative row strides are handled correctly - CVE-2026-22801 * SECURITY UPDATE: Heap buffer overflow in png_set_quantize due to stale palette indices stored in the color distance hash table - debian/patches/CVE-2026-25646.patch: store original palette indices via palette_to_index in png_set_quantize so the color-pruning loop does not read past the 769-element hash array - CVE-2026-25646 Important TuxCare License Agreement CVE-2025-65018 CVE-2026-22801 CVE-2026-25646 CVE-2025-66293 CVE-2025-64720 Ubuntu 20.04 LTS * SECURITY UPDATE: Samba AD DC did not enforce the Validated-DNS-Host-Name write right, allowing an unprivileged authenticated user with machine account write access (e.g. SeMachineAccountPrivilege) to set the dNSHostName attribute to an arbitrary value, bypassing the MS-ADTS requirement that it match <sAMAccountName-sans-$>.<dnsDomainName>. This primitive is commonly chained with CVE-2022-26923 (Certifried) via AD CS to forge a machine certificate and escalate to Domain Admin. - debian/patches/CVE-2022-32743.patch - CVE-2022-32743 Important TuxCare License Agreement CVE-2022-32743 Ubuntu 20.04 LTS * SECURITY UPDATE: directory traversal in cpio extraction - debian/patches/CVE-2023-39810.patch: add FEATURE_PATH_TRAVERSAL_PROTECTION config option, call strip_unsafe_prefix() in data_extract_all.c to prevent path traversal via ../ in archive filenames. Covers cpio, ar, rpm. - Enable CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION=y in all build configs. - debian/patches/CVE-2023-39810.patch: replace `echo -e` with `printf` in the new cpio path-traversal testcase so it is portable to dash (the Ubuntu /bin/sh). - debian/testsuite-linux.diff: skip the pre-existing "cpio uses by default uid/gid" test, which is fragile in the pbuilder chroot (id -u returns 0 but source files retain uid=1000 from the build worker, causing a spurious mismatch). - debian/patches/CVE-2023-39810.patch: include the "1 blocks" summary line that busybox cpio -vi emits (to stderr, merged via 2>&1) at end-of-archive in the expected output of the new path-traversal testcase; the functional check (file not written, exit 0) already passed but the string-match failed because 1.30.1 always prints "N blocks", matching the pattern used by other cpio tests in testsuite/cpio.tests. - debian/testsuite-linux.diff: skip the pre-existing hostname-d-works test when the pbuilder chroot cannot resolve its own hostname via DNS (no /etc/hosts entry for the build host). - CVE-2023-39810 Important TuxCare License Agreement CVE-2023-39810 Ubuntu 20.04 LTS * SECURITY UPDATE: systemctl may pass arbitrary shell commands from a pager like more(1) that does not honor LESSSECURE, allowing privilege escalation under sudo. - debian/patches/CVE-2023-26604.patch: set LESSSECURE=1 when invoking a pager, rename to SYSTEMD_PAGERSECURE, gate insecure pagers behind sd_pid_get_owner_uid()/euid check, skip non-"less" pagers in secure mode, and read the envvar via secure_getenv(). Squash of upstream commits 612ebf6c91, 0a42426d79, and b8f736b30e (src/shared/pager.c only; man-page hunks dropped). - CVE-2023-26604 Important TuxCare License Agreement CVE-2023-26604 Ubuntu 20.04 LTS * SECURITY UPDATE: multiple vulnerabilities in Edge Side Includes (ESI) processing - debian/rules: build with --disable-esi to remove the vulnerable ESI response processor (matches the upstream Squid 6.10 default, where ESI support is disabled by default). - debian/control: drop libexpat1-dev and libxml2-dev Build-Depends as they are no longer required when ESI is disabled. - CVE-2024-45802 Important TuxCare License Agreement CVE-2024-45802 Ubuntu 20.04 LTS * SECURITY UPDATE: A NULL pointer dereference in rsa_cms_decrypt() when processing CMS messages with RSA-OAEP encryption where pSourceFunc is present but its parameters field is absent can trigger a crash, leading to Denial of Service. - debian/patches/CVE-2026-28390.patch: use X509_ALGOR_get0 and ASN1_STRING_* accessors to safely parse pSourceFunc; duplicate the OAEP label before handing it to EVP_PKEY_CTX_set0_rsa_oaep_label. - CVE-2026-28390 Important TuxCare License Agreement CVE-2026-28390 Ubuntu 20.04 LTS * OpenJDK 11.0.30 release, build 7. - CVE-2026-21925: Improve JMX connections - CVE-2026-21932: Enhance handling of URIs (AWT/JavaFX) - CVE-2026-21933: Improve HttpServer request handling - CVE-2026-21945: Enhance certificate checking - Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2026-January/051739.html Important TuxCare License Agreement CVE-2026-21945 Ubuntu 20.04 LTS * SECURITY UPDATE: stack overwriting via crafted cgroup path - debian/patches/CVE-2026-29111.patch: validate input cgroup path in method_get_unit_by_control_group with path_is_absolute() and path_is_normalized() checks before passing to manager_get_unit_by_cgroup(). - CVE-2026-29111 Important TuxCare License Agreement CVE-2026-29111 Ubuntu 20.04 LTS * SECURITY UPDATE: HTTP::Tiny does not verify TLS certificates by default - debian/patches/CVE-2023-31486.patch: flip verify_SSL default from 0 to 1 in cpan/HTTP-Tiny/lib/HTTP/Tiny.pm; add PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT escape-hatch env var; update POD (SSL SUPPORT -> TLS/SSL SUPPORT, machine-in-the-middle, extra CA search paths); add offline regression test cpan/HTTP-Tiny/t/180_verify_SSL.t. - CVE-2023-31486 Important TuxCare License Agreement CVE-2023-31486 Ubuntu 20.04 LTS * No-source-change rebuild against libpng (>= 1.6.37-2+tuxcare.els2) to pick up the libpng security fixes for: - CVE-2025-64720: png_image_read_composite OOB read on palette images with PNG_FLAG_OPTIMIZE_ALPHA (libpng < 1.6.51). - CVE-2025-65018: png_image_finish_read heap buffer overflow on 16-bit interlaced PNGs with 8-bit output (libpng < 1.6.51). Both vulnerabilities live entirely in libpng (used in OpenJDK only via the system libpng linked into libsplashscreen / AWT image decoding via libsplashscreen --with-libpng=system); no OpenJDK source change is required. The fix is delivered by the libpng rebuild (build 69ef31c7922f4d8bf30fd637, libpng1.6 1.6.37-2+tuxcare.els2). Bumping the Build-Depends floor on libpng-dev guarantees the fixed headers/library are linked in this rebuild. Important TuxCare License Agreement CVE-2025-65018 CVE-2025-64720 Ubuntu 20.04 LTS * SECURITY UPDATE: setuid/setgid bits preserved on scp downloads without -p - debian/patches/CVE-2026-35385.patch: in legacy (-O) mode, OR 07000 into the saved umask in sink() in scp.c so that setuid/setgid/sticky bits are stripped from received files when -p is not specified. - CVE-2026-35385 Important TuxCare License Agreement CVE-2026-35385 Ubuntu 20.04 LTS * CVE-2026-31431 - crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431} - crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431} - crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431} - crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431} - crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431} - crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431} - crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431} * CVE-2022-49720 - block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720} * CVE-2024-49960 - ext4: fix timer use-after-free on failed mount {CVE-2024-49960} * CVE-2025-71086 - net: rose: fix invalid array index in rose_kill_by_device() {CVE-2025-71086} * CVE-2026-23073 - wifi: rsi: Fix memory corruption due to not set vif driver data size {CVE-2026-23073} * CVE-2022-49900 - i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900} * CVE-2022-43945 - NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945} * Miscellaneous upstream changes - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091} - scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075} - tuxcare: update version Important TuxCare License Agreement CVE-2024-49960 CVE-2025-71075 CVE-2026-23073 CVE-2022-49720 CVE-2022-50410 CVE-2025-71091 CVE-2025-71086 CVE-2022-49900 CVE-2026-31431 Ubuntu 20.04 LTS * SECURITY UPDATE: TOCTOU race in cap_set_file() - debian/patches/CVE-2026-4878.patch: lock onto the target file via an O_PATH descriptor and operate via /proc/self/fd/N in libcap/cap_file.c so that file capability changes cannot be redirected to an attacker- controlled file by a local user with write access to a parent directory. - CVE-2026-4878 Important TuxCare License Agreement CVE-2026-4878 Ubuntu 20.04 LTS * SECURITY UPDATE: URL parsing accepts ASCII tab/CR/LF (URL smuggling) - debian/patches/CVE-2022-0391.patch: sanitise tab, CR, LF anywhere in URL/scheme inside urlsplit() before cache lookup, plus regression test in Lib/urlparse.py, Lib/test/test_urlparse.py. - CVE-2022-0391 * SECURITY UPDATE: Quadratic complexity in IDNA decoding (DoS) - debian/patches/CVE-2022-45061.patch: replace O(n) outer loop with a single any() guard in nameprep(), plus regression test in Lib/encodings/idna.py, Lib/test/test_codecs.py. - CVE-2022-45061 * SECURITY UPDATE: ReDoS in Cookie._unquote (quadratic backslash parsing) - debian/patches/CVE-2024-7592.patch: replace the quadratic _OctalPatt / _QuotePatt loop with a single linear re.sub-based decoder, plus regression tests in Lib/Cookie.py, Lib/test/test_cookie.py. - CVE-2024-7592 * SECURITY UPDATE: webbrowser.open() argument injection via leading dash - debian/patches/CVE-2026-4519.patch: add BaseBrowser._check_url() and call it from every browser open() to reject URLs whose first non-whitespace char is '-', plus regression test in Lib/webbrowser.py, Lib/test/test_webbrowser.py. Also backports upstream gh-148169 (commit d22922c8a7) to close the %action-substitution bypass: the check is deferred until after %action substitution and the per-arg replace() chain is reordered (%action before %s) so an attacker cannot smuggle a leading dash via the URL. - CVE-2026-4519 * BUILD: replace libdb-dev (<< 1:6.0) with libdb5.3-dev in debian/control{,.in} so the build pulls the explicit Berkeley DB 5.3 development headers available on Ubuntu 20.04 ESM, instead of the virtual libdb-dev package that is no longer satisfied in the ELS build environment. Important TuxCare License Agreement CVE-2026-4519 CVE-2024-7592 CVE-2022-0391 CVE-2022-45061 Ubuntu 20.04 LTS * SECURITY UPDATE: heap buffer underflow in ssh_get_hexa() when called with a NULL pointer or zero-length input - debian/patches/CVE-2026-0966.patch: add NULL/zero-length input validation in ssh_get_hexa(); add unit-test coverage - CVE-2026-0966 Important TuxCare License Agreement CVE-2026-0966 Ubuntu 20.04 LTS * SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape decoding when running against musl libc - debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain() to consume 1, 2, or 3 digits incrementally instead of indexing past the input string when fewer than 3 digits follow a backslash escape - CVE-2026-40684 * SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed header value ending in a trailing backslash - debian/patches/CVE-2026-40685.patch: only skip a backslash in dewrap() when followed by a non-NUL character - CVE-2026-40685 * SECURITY UPDATE: SPA authenticator out-of-bounds write and uninitialised-heap information disclosure - debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits() output buffer to plug the infoleak; replace assert()-based length guards in unicodeToString(), strToUnicode(), and toString() with explicit length clamping to prevent OOB writes - CVE-2026-40687 Critical TuxCare License Agreement CVE-2026-40684 CVE-2026-40687 CVE-2026-40685 Ubuntu 20.04 LTS * SECURITY UPDATE: double free and possible remote code execution via HTTP/2 stream double-purge in mod_http2 - debian/patches/CVE-2026-23918.patch: prevent double purge of a stream by introducing add_for_purge() helper that checks for duplicates before adding to the purge queue in modules/http2/h2_mplx.c - CVE-2026-23918 Important TuxCare License Agreement CVE-2026-23918 Ubuntu 20.04 LTS * Miscellaneous Ubuntu changes - [Packaging]: add tuxcare suffix * Miscellaneous upstream changes - xfrm: esp: avoid in-place decrypt on shared skb frags - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present Important TuxCare License Agreement CVE-2026-43284 Ubuntu 20.04 LTS * SECURITY UPDATE: A use-after-free / heap corruption in dane_match() of the X.509 verifier where the cached DANE-matched certificate was freed via OPENSSL_free() instead of X509_free(), bypassing the X509 reference counting and freeing certificate fields that may still be referenced by other holders. An attacker able to influence the DANE TLSA records used during certificate verification can trigger memory corruption. - debian/patches/CVE-2026-28387.patch: replace OPENSSL_free(dane->mcert) with X509_free(dane->mcert) in dane_match() in crypto/x509/x509_vfy.c. - CVE-2026-28387 * SECURITY UPDATE: A NULL pointer dereference in check_delta_base() of the X.509 CRL verifier when a delta CRL lacks the CRL Number extension. A remote attacker controlling a delta CRL can trigger a crash, leading to Denial of Service in applications using -crl_check with -use_deltas. - debian/patches/CVE-2026-28388.patch: NULL-check delta->crl_number before passing it to ASN1_INTEGER_cmp() in check_delta_base() in crypto/x509/x509_vfy.c, and ship the upstream test fixtures and verify recipe. - CVE-2026-28388 Important TuxCare License Agreement CVE-2026-28388 CVE-2026-28387 Ubuntu 20.04 LTS * SECURITY UPDATE: imap-login excessive memory usage DoS (ELSCVE-123445) - debian/patches/CVE-2026-27857.patch: limit IMAP parser open list count via new imap_parser_params struct; cap pre-auth IMAP_LOGIN_LIST_COUNT_LIMIT to 1. Squashes upstream commits 825bc297, d0f67b52, af1fb4da, 3435e0d44. - CVE-2026-27857 Important TuxCare License Agreement CVE-2026-27857 Ubuntu 20.04 LTS * Security: - CVE-2026-25576: heap buffer over-read in raw pixel coders - CVE-2026-28688: use-after-free in MSL encoder - CVE-2026-28690: stack-based buffer overflow in MNG/JNG encoder Moderate TuxCare License Agreement CVE-2026-28688 CVE-2026-28690 CVE-2026-25576 Ubuntu 20.04 LTS * SECURITY UPDATE: NULL pointer dereference in SOAP apache:Map decoder - debian/patches/CVE-2026-7262.patch: fix wrong variable checked in to_zval_map() NULL check, changing if (!xmlKey) to if (!xmlValue) - CVE-2026-7262 * SECURITY UPDATE: Signed integer overflow in metaphone() char array offset - debian/patches/CVE-2026-7568.patch: widen w_idx in metaphone() and how_far/idx in Lookahead() from int to size_t in ext/standard/metaphone.c to prevent signed overflow on inputs exceeding 2^31 bytes - CVE-2026-7568 * SECURITY UPDATE: Denial of service via signed char passed to ctype functions - debian/patches/CVE-2026-7258.patch: consistently cast chars to unsigned char before all ctype.h calls (isxdigit, isdigit, isalpha, isalnum, isspace, tolower, toupper) across 54 files including ext/standard/url.c (php_url_decode, php_raw_url_decode) and ext/standard/formatted_print.c, Zend/zend_virtual_cwd.c, and others - CVE-2026-7258 Critical TuxCare License Agreement CVE-2026-7262 CVE-2025-14179 CVE-2026-7258 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Ubuntu 20.04 LTS * SECURITY UPDATE: Certificate policy bypass via case-sensitive nameConstraints - debian/patches/CVE-2026-3833.patch: replace memcmp with c_strncasecmp in ends_with, email_ends_with, dnsname_matches and email_matches in lib/x509/name_constraints.c so DNS labels and email domains are compared case-insensitively per RFC 5280 7.2 - CVE-2026-3833 Critical TuxCare License Agreement CVE-2026-33845 CVE-2026-3833 Ubuntu 20.04 LTS * SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE - debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE - CVE-2024-11003 * SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE - debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE - CVE-2024-48990 * SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression - debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression - CVE-2024-48991 * SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE - CVE-2024-48992 Low TuxCare License Agreement CVE-2024-48992 CVE-2024-48990 CVE-2024-48991 CVE-2024-11003 Ubuntu 20.04 LTS * SECURITY UPDATE: Authentication bypass via NUL-byte truncation in RSA-PSK username lookup - debian/patches/CVE-2026-42010.patch: replace strlen(info->username) with info->username_len in _gnutls_proc_rsa_psk_client_kx in lib/auth/rsa_psk.c to prevent NUL-byte truncation allowing username matching with truncated entries - CVE-2026-42010 Critical TuxCare License Agreement CVE-2026-42010 Ubuntu 20.04 LTS * SECURITY UPDATE: off-by-one OOB read in mod_proxy_ajp message getters - debian/patches/CVE-2026-33857.patch: tighten length checks (`> msg->len` -> `>= msg->len`) in ajp_msg_get_uint8/16/32 and ajp_msg_peek_uint8/16 in modules/proxy/ajp_msg.c. - CVE-2026-33857 * SECURITY UPDATE: heap over-read in mod_proxy_ajp via missing null-termination check in ajp_msg_get_string() - debian/patches/CVE-2026-34032.patch: switch the buffer overflow check to compare against msg->len and verify the expected null terminator is present before returning the pointer in modules/proxy/ajp_msg.c. - CVE-2026-34032 * SECURITY UPDATE: heap over-read and memory disclosure in mod_proxy_ajp ajp_parse_data() via missing minimum message-length validation - debian/patches/CVE-2026-34059.patch: reject AJP data messages whose `msg->len` is smaller than AJP_HEADER_LEN + AJP_HEADER_SZ_LEN + 1 + 1 before computing expected_len in modules/proxy/ajp_header.c. - CVE-2026-34059 * SECURITY UPDATE: local information disclosure via .htaccess / mod_setenvif / ProxyFCGISetEnvIf, where a non-privileged user with .htaccess write access could read files accessible to the httpd service account - debian/patches/CVE-2026-24072.patch: pass AP_EXPR_FLAG_RESTRICTED when parsing ap_expr expressions from htaccess context in modules/mappers/mod_rewrite.c, modules/metadata/mod_setenvif.c, and modules/proxy/mod_proxy_fcgi.c. - CVE-2026-24072 * SECURITY UPDATE: timing attack against mod_auth_digest allowing bypass of Digest authentication - debian/patches/CVE-2026-33006.patch: validate nonce and digest lengths earlier and replace the strcmp of the nonce hash with the constant-time apr_crypto_equals (apr-util >= 1.6) in modules/aaa/mod_auth_digest.c; bump APU minimum to 1.6 in configure.in. - CVE-2026-33006 * SECURITY UPDATE: NULL pointer dereference in mod_authn_socache crashes the child process in a caching forward proxy setup - debian/patches/CVE-2026-33007.patch: validate the URL before using the cache hash in construct_key() in modules/aaa/mod_authn_socache.c. - CVE-2026-33007 * SECURITY UPDATE: HTTP response splitting via newline/control characters in an outgoing status line forwarded from a compromised backend - debian/patches/CVE-2026-33523.patch: reject status reason strings that contain newlines or control characters in modules/http/http_filters.c. - CVE-2026-33523 Important TuxCare License Agreement CVE-2026-34059 CVE-2026-33006 CVE-2026-24072 CVE-2026-33523 CVE-2026-33857 CVE-2026-34032 CVE-2026-33007 /etc/els-release Ubuntu 20\.04 LTS \(ELS by TuxCare\) 1 libnginx-mod-http-auth-pam libnginx-mod-http-cache-purge libnginx-mod-http-dav-ext libnginx-mod-http-echo libnginx-mod-http-fancyindex libnginx-mod-http-geoip libnginx-mod-http-geoip2 libnginx-mod-http-headers-more-filter libnginx-mod-http-image-filter libnginx-mod-http-lua libnginx-mod-http-ndk libnginx-mod-http-perl libnginx-mod-http-subs-filter libnginx-mod-http-uploadprogress libnginx-mod-http-upstream-fair libnginx-mod-http-xslt-filter libnginx-mod-mail libnginx-mod-nchan libnginx-mod-rtmp libnginx-mod-stream nginx nginx-common nginx-core nginx-doc nginx-extras nginx-full nginx-light libtomcat9-embed-java libtomcat9-java tomcat9 tomcat9-admin tomcat9-common tomcat9-docs tomcat9-examples tomcat9-user libxml2 libxml2-dev libxml2-doc libxml2-utils python-libxml2 python3-libxml2 linux-cloud-tools-5.4.0-220-tuxcare.els2 linux-cloud-tools-5.4.0-220-tuxcare.els2-generic linux-cloud-tools-common linux-headers-5.4.0-220-tuxcare.els2-generic linux-headers-5.4.0-220-tuxcare.els2-lowlatency linux-image-unsigned-5.4.0-220-tuxcare.els2-generic linux-modules-5.4.0-220-tuxcare.els2-lowlatency linux-modules-extra-5.4.0-220-tuxcare.els2-generic linux-tools-5.4.0-220-tuxcare.els2-generic linux-tools-5.4.0-220-tuxcare.els2-lowlatency sudo sudo-ldap lemon libsqlite3-0 libsqlite3-dev libsqlite3-tcl sqlite3 sqlite3-doc git git-all git-cvs git-daemon-run git-daemon-sysvinit git-doc git-el git-email git-gui git-man git-mediawiki git-svn gitk gitweb imagemagick imagemagick-6-common imagemagick-6-doc imagemagick-6.q16 imagemagick-6.q16hdri imagemagick-common imagemagick-doc libimage-magick-perl libimage-magick-q16-perl libimage-magick-q16hdri-perl libmagick++-6-headers libmagick++-6.q16-8 libmagick++-6.q16-dev libmagick++-6.q16hdri-8 libmagick++-6.q16hdri-dev libmagick++-dev libmagickcore-6-arch-config libmagickcore-6-headers libmagickcore-6.q16-6 libmagickcore-6.q16-6-extra libmagickcore-6.q16-dev libmagickcore-6.q16hdri-6 libmagickcore-6.q16hdri-6-extra libmagickcore-6.q16hdri-dev libmagickcore-dev libmagickwand-6-headers libmagickwand-6.q16-6 libmagickwand-6.q16-dev libmagickwand-6.q16hdri-6 libmagickwand-6.q16hdri-dev libmagickwand-dev perlmagick libssh-4 libssh-dev libssh-doc libssh-gcrypt-4 libssh-gcrypt-dev linux-buildinfo-5.4.0-221-tuxcare.els3-generic linux-buildinfo-5.4.0-221-tuxcare.els3-lowlatency linux-cloud-tools-5.4.0-221-tuxcare.els3 linux-cloud-tools-5.4.0-221-tuxcare.els3-generic linux-cloud-tools-5.4.0-221-tuxcare.els3-lowlatency linux-doc linux-headers-5.4.0-221-tuxcare.els3 linux-headers-5.4.0-221-tuxcare.els3-generic linux-headers-5.4.0-221-tuxcare.els3-lowlatency linux-image-unsigned-5.4.0-221-tuxcare.els3-generic linux-image-unsigned-5.4.0-221-tuxcare.els3-lowlatency linux-libc-dev linux-modules-5.4.0-221-tuxcare.els3-generic linux-modules-5.4.0-221-tuxcare.els3-lowlatency linux-modules-extra-5.4.0-221-tuxcare.els3-generic linux-source-5.4.0 linux-tools-5.4.0-221-tuxcare.els3 linux-tools-5.4.0-221-tuxcare.els3-generic linux-tools-5.4.0-221-tuxcare.els3-lowlatency linux-tools-common linux-tools-host libapache2-mod-php7.4 libphp7.4-embed php7.4 php7.4-bcmath php7.4-bz2 php7.4-cgi php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-dev php7.4-enchant php7.4-fpm php7.4-gd php7.4-gmp php7.4-imap php7.4-interbase php7.4-intl php7.4-json php7.4-ldap php7.4-mbstring php7.4-mysql php7.4-odbc php7.4-opcache php7.4-pgsql php7.4-phpdbg php7.4-pspell php7.4-readline php7.4-snmp php7.4-soap php7.4-sqlite3 php7.4-sybase php7.4-tidy php7.4-xml php7.4-xmlrpc php7.4-xsl php7.4-zip linux-buildinfo-5.4.0-222-tuxcare.els4-generic linux-buildinfo-5.4.0-222-tuxcare.els4-lowlatency linux-cloud-tools-5.4.0-222-tuxcare.els4 linux-cloud-tools-5.4.0-222-tuxcare.els4-generic linux-cloud-tools-5.4.0-222-tuxcare.els4-lowlatency linux-cloud-tools-generic linux-cloud-tools-lowlatency linux-generic linux-headers-5.4.0-222-tuxcare.els4 linux-headers-5.4.0-222-tuxcare.els4-generic linux-headers-5.4.0-222-tuxcare.els4-lowlatency linux-headers-generic linux-headers-lowlatency linux-image-generic linux-image-lowlatency linux-image-unsigned-5.4.0-222-tuxcare.els4-generic linux-image-unsigned-5.4.0-222-tuxcare.els4-lowlatency linux-lowlatency linux-modules-5.4.0-222-tuxcare.els4-generic linux-modules-5.4.0-222-tuxcare.els4-lowlatency linux-modules-extra-5.4.0-222-tuxcare.els4-generic linux-tools-5.4.0-222-tuxcare.els4 linux-tools-5.4.0-222-tuxcare.els4-generic linux-tools-5.4.0-222-tuxcare.els4-lowlatency linux-tools-generic linux-tools-lowlatency squid squid-cgi squid-common squid-purge squidclient linux-buildinfo-5.4.0-223-tuxcare.els5-generic linux-buildinfo-5.4.0-223-tuxcare.els5-lowlatency linux-cloud-tools-5.4.0-223-tuxcare.els5 linux-cloud-tools-5.4.0-223-tuxcare.els5-generic linux-cloud-tools-5.4.0-223-tuxcare.els5-lowlatency linux-headers-5.4.0-223-tuxcare.els5 linux-headers-5.4.0-223-tuxcare.els5-generic linux-headers-5.4.0-223-tuxcare.els5-lowlatency linux-image-unsigned-5.4.0-223-tuxcare.els5-generic linux-image-unsigned-5.4.0-223-tuxcare.els5-lowlatency linux-modules-5.4.0-223-tuxcare.els5-generic linux-modules-5.4.0-223-tuxcare.els5-lowlatency linux-modules-extra-5.4.0-223-tuxcare.els5-generic linux-tools-5.4.0-223-tuxcare.els5 linux-tools-5.4.0-223-tuxcare.els5-generic linux-tools-5.4.0-223-tuxcare.els5-lowlatency binutils binutils-aarch64-linux-gnu binutils-alpha-linux-gnu binutils-arm-linux-gnueabi binutils-arm-linux-gnueabihf binutils-common binutils-dev binutils-doc binutils-for-build binutils-for-host binutils-hppa-linux-gnu binutils-hppa64-linux-gnu binutils-i686-gnu binutils-i686-kfreebsd-gnu binutils-i686-linux-gnu binutils-ia64-linux-gnu binutils-m68k-linux-gnu binutils-multiarch binutils-multiarch-dev binutils-powerpc-linux-gnu binutils-powerpc64-linux-gnu binutils-powerpc64le-linux-gnu binutils-riscv64-linux-gnu binutils-s390x-linux-gnu binutils-sh4-linux-gnu binutils-source binutils-sparc64-linux-gnu binutils-x86-64-kfreebsd-gnu binutils-x86-64-linux-gnu binutils-x86-64-linux-gnux32 libbinutils libctf-nobfd0 libctf0 dirmngr gnupg gnupg-agent gnupg-l10n gnupg-utils gnupg2 gpg gpg-agent gpg-wks-client gpg-wks-server gpgconf gpgsm gpgv gpgv-static gpgv-win32 gpgv2 scdaemon cups cups-bsd cups-client cups-common cups-core-drivers cups-daemon cups-ipp-utils cups-ppdc cups-server-common libcups2 libcups2-dev libcupsimage2 libcupsimage2-dev expat libexpat1 libexpat1-dev glibc-doc glibc-source libc-bin libc-dev-bin libc6 libc6-dev libc6-dev-i386 libc6-dev-x32 libc6-i386 libc6-pic libc6-prof libc6-x32 locales locales-all nscd libssl-dev libssl-doc libssl1.1 openssl libglib2.0-0 libglib2.0-bin libglib2.0-data libglib2.0-dev libglib2.0-dev-bin libglib2.0-doc libglib2.0-tests openjdk-8-demo openjdk-8-doc openjdk-8-jdk openjdk-8-jdk-headless openjdk-8-jre openjdk-8-jre-headless openjdk-8-jre-zero openjdk-8-source linux-buildinfo-5.4.0-225-tuxcare.els7-generic linux-buildinfo-5.4.0-225-tuxcare.els7-lowlatency linux-cloud-tools-5.4.0-225-tuxcare.els7 linux-cloud-tools-5.4.0-225-tuxcare.els7-generic linux-cloud-tools-5.4.0-225-tuxcare.els7-lowlatency linux-headers-5.4.0-225-tuxcare.els7 linux-headers-5.4.0-225-tuxcare.els7-generic linux-headers-5.4.0-225-tuxcare.els7-lowlatency linux-image-unsigned-5.4.0-225-tuxcare.els7-generic linux-image-unsigned-5.4.0-225-tuxcare.els7-lowlatency linux-modules-5.4.0-225-tuxcare.els7-generic linux-modules-5.4.0-225-tuxcare.els7-lowlatency linux-modules-extra-5.4.0-225-tuxcare.els7-generic linux-tools-5.4.0-225-tuxcare.els7 linux-tools-5.4.0-225-tuxcare.els7-generic linux-tools-5.4.0-225-tuxcare.els7-lowlatency curl libcurl3-gnutls libcurl3-nss libcurl4 libcurl4-doc libcurl4-gnutls-dev libcurl4-nss-dev libcurl4-openssl-dev ctdb libnss-winbind libpam-winbind libsmbclient libsmbclient-dev libwbclient-dev libwbclient0 python3-samba registry-tools samba samba-common samba-common-bin samba-dev samba-dsdb-modules samba-libs samba-testsuite samba-vfs-modules smbclient winbind mongodb mongodb-clients mongodb-server mongodb-server-core apache2 apache2-bin apache2-data apache2-dev apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-pristine apache2-utils libapache2-mod-md libapache2-mod-proxy-uwsgi openssh-client openssh-server openssh-sftp-server openssh-tests ssh ssh-askpass-gnome linux-buildinfo-5.4.0-226-tuxcare.els8-generic linux-buildinfo-5.4.0-226-tuxcare.els8-lowlatency linux-cloud-tools-5.4.0-226-tuxcare.els8 linux-cloud-tools-5.4.0-226-tuxcare.els8-generic linux-cloud-tools-5.4.0-226-tuxcare.els8-lowlatency linux-headers-5.4.0-226-tuxcare.els8 linux-headers-5.4.0-226-tuxcare.els8-generic linux-headers-5.4.0-226-tuxcare.els8-lowlatency linux-image-unsigned-5.4.0-226-tuxcare.els8-generic linux-image-unsigned-5.4.0-226-tuxcare.els8-lowlatency linux-modules-5.4.0-226-tuxcare.els8-generic linux-modules-5.4.0-226-tuxcare.els8-lowlatency linux-modules-extra-5.4.0-226-tuxcare.els8-generic linux-tools-5.4.0-226-tuxcare.els8 linux-tools-5.4.0-226-tuxcare.els8-generic linux-tools-5.4.0-226-tuxcare.els8-lowlatency linux-buildinfo-5.4.0-227-tuxcare.els9-generic linux-buildinfo-5.4.0-227-tuxcare.els9-lowlatency linux-cloud-tools-5.4.0-227-tuxcare.els9 linux-cloud-tools-5.4.0-227-tuxcare.els9-generic linux-cloud-tools-5.4.0-227-tuxcare.els9-lowlatency linux-headers-5.4.0-227-tuxcare.els9 linux-headers-5.4.0-227-tuxcare.els9-generic linux-headers-5.4.0-227-tuxcare.els9-lowlatency linux-image-unsigned-5.4.0-227-tuxcare.els9-generic linux-image-unsigned-5.4.0-227-tuxcare.els9-lowlatency linux-modules-5.4.0-227-tuxcare.els9-generic linux-modules-5.4.0-227-tuxcare.els9-lowlatency linux-modules-extra-5.4.0-227-tuxcare.els9-generic linux-tools-5.4.0-227-tuxcare.els9 linux-tools-5.4.0-227-tuxcare.els9-generic linux-tools-5.4.0-227-tuxcare.els9-lowlatency gnutls-bin gnutls-doc guile-gnutls libgnutls-dane0 libgnutls-openssl27 libgnutls28-dev libgnutls30 libgnutlsxx28 libpng-dev libpng-tools libpng16-16 busybox busybox-initramfs busybox-static busybox-syslogd udhcpc udhcpd libnss-myhostname libnss-mymachines libnss-resolve libnss-systemd libpam-systemd libsystemd-dev libsystemd0 libudev-dev libudev1 systemd systemd-container systemd-coredump systemd-journal-remote systemd-sysv systemd-tests systemd-timesyncd udev openjdk-11-demo openjdk-11-doc openjdk-11-jdk openjdk-11-jdk-headless openjdk-11-jre openjdk-11-jre-headless openjdk-11-jre-zero openjdk-11-source libperl-dev libperl5.30 perl perl-base perl-debug perl-doc perl-modules-5.30 linux-buildinfo-5.4.0-228-tuxcare.els10-generic linux-buildinfo-5.4.0-228-tuxcare.els10-lowlatency linux-cloud-tools-5.4.0-228-tuxcare.els10 linux-cloud-tools-5.4.0-228-tuxcare.els10-generic linux-cloud-tools-5.4.0-228-tuxcare.els10-lowlatency linux-headers-5.4.0-228-tuxcare.els10 linux-headers-5.4.0-228-tuxcare.els10-generic linux-headers-5.4.0-228-tuxcare.els10-lowlatency linux-image-unsigned-5.4.0-228-tuxcare.els10-generic linux-image-unsigned-5.4.0-228-tuxcare.els10-lowlatency linux-modules-5.4.0-228-tuxcare.els10-generic linux-modules-5.4.0-228-tuxcare.els10-lowlatency linux-modules-extra-5.4.0-228-tuxcare.els10-generic linux-tools-5.4.0-228-tuxcare.els10 linux-tools-5.4.0-228-tuxcare.els10-generic linux-tools-5.4.0-228-tuxcare.els10-lowlatency libcap-dev libcap2 libcap2-bin libpam-cap idle-python2.7 libpython2.7 libpython2.7-dev libpython2.7-minimal libpython2.7-stdlib libpython2.7-testsuite python2.7 python2.7-dev python2.7-doc python2.7-examples python2.7-minimal exim4 exim4-base exim4-config exim4-daemon-heavy exim4-daemon-light exim4-dev eximon4 linux-buildinfo-5.4.0-229-tuxcare.els11-generic linux-buildinfo-5.4.0-229-tuxcare.els11-lowlatency linux-cloud-tools-5.4.0-229-tuxcare.els11 linux-cloud-tools-5.4.0-229-tuxcare.els11-generic linux-cloud-tools-5.4.0-229-tuxcare.els11-lowlatency linux-headers-5.4.0-229-tuxcare.els11 linux-headers-5.4.0-229-tuxcare.els11-generic linux-headers-5.4.0-229-tuxcare.els11-lowlatency linux-image-unsigned-5.4.0-229-tuxcare.els11-generic linux-image-unsigned-5.4.0-229-tuxcare.els11-lowlatency linux-modules-5.4.0-229-tuxcare.els11-generic linux-modules-5.4.0-229-tuxcare.els11-lowlatency linux-modules-extra-5.4.0-229-tuxcare.els11-generic linux-tools-5.4.0-229-tuxcare.els11 linux-tools-5.4.0-229-tuxcare.els11-generic linux-tools-5.4.0-229-tuxcare.els11-lowlatency dovecot-auth-lua dovecot-core dovecot-dev dovecot-gssapi dovecot-imapd dovecot-ldap dovecot-lmtpd dovecot-lucene dovecot-managesieved dovecot-mysql dovecot-pgsql dovecot-pop3d dovecot-sieve dovecot-solr dovecot-sqlite dovecot-submissiond mail-stack-delivery needrestart amd64 0:1.18.0-0ubuntu1.7+tuxcare.els1 0:1.18.0-0ubuntu1.7+tuxcare.els1 0:9.0.31-1ubuntu0.8+tuxcare.els1 0:9.0.31-1ubuntu0.8+tuxcare.els2 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els1 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els1 0:9.0.31-1ubuntu0.9+tuxcare.els1 (^5\.4\.0\-(\d{4,}|[3-9]\d{2}|2[3-9]\d|22[0-9])\-tuxcare\.els(\d{2,}|[2-9])(\-\w*)?$) amd64 0:5.4.0-220.240 0:5.4.0-220.240 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els2 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els2 amd64 0:1.8.31-1ubuntu1.5+tuxcare.els1 amd64 0:3.31.1-4ubuntu0.7+tuxcare.els1 0:3.31.1-4ubuntu0.7+tuxcare.els1 amd64 1:2.25.1-1ubuntu3.14+tuxcare.els1 1:2.25.1-1ubuntu3.14+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els1 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els1 amd64 0:0.9.3-2ubuntu2.5+tuxcare.els1 0:0.9.3-2ubuntu2.5+tuxcare.els1 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els3 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els3 (^5\.4\.0\-(\d{4,}|[3-9]\d{2}|2[3-9]\d|22[1-9])\-tuxcare\.els(\d{2,}|[3-9])(\-\w*)?$) amd64 0:5.4.0-221.241 0:5.4.0-221.241 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els4 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els4 amd64 0:7.4.3-4ubuntu2.29+tuxcare.els1 0:7.4.3-4ubuntu2.29+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els3 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els3 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els4 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els4 amd64 0:0.9.3-2ubuntu2.5+tuxcare.els2 0:0.9.3-2ubuntu2.5+tuxcare.els2 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els5 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els5 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els8 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els8 amd64 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els5 0:2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els5 (^5\.4\.0\-(\d{4,}|[3-9]\d{2}|2[3-9]\d|22[2-9])\-tuxcare\.els(\d{2,}|[4-9])(\-\w*)?$) amd64 0:5.4.0-222.242 0:5.4.0-222.242 amd64 0:5.4.0.222.242 amd64 0:4.10-1ubuntu1.13+tuxcare.els1 0:4.10-1ubuntu1.13+tuxcare.els1 (^5\.4\.0\-(\d{4,}|[3-9]\d{2}|2[3-9]\d|22[3-9])\-tuxcare\.els(\d{2,}|[5-9])(\-\w*)?$) amd64 0:5.4.0-223.243 0:5.4.0-223.243 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els9 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els9 amd64 0:2.34-6ubuntu1.11+tuxcare.els1 0:2.34-6ubuntu1.11+tuxcare.els1 amd64 0:7.4.3-4ubuntu2.29+tuxcare.els2 0:7.4.3-4ubuntu2.29+tuxcare.els2 amd64 0:2.34-6ubuntu1.11+tuxcare.els3 0:2.34-6ubuntu1.11+tuxcare.els3 amd64 0:2.34-6ubuntu1.11+tuxcare.els4 0:2.34-6ubuntu1.11+tuxcare.els4 amd64 0:2.2.19-3ubuntu2.5+tuxcare.els1 0:2.2.19-3ubuntu2.5+tuxcare.els1 amd64 0:2.34-6ubuntu1.11+tuxcare.els5 0:2.34-6ubuntu1.11+tuxcare.els5 amd64 0:2.3.1-9ubuntu1.9+tuxcare.els1 0:2.3.1-9ubuntu1.9+tuxcare.els1 amd64 0:2.2.9-1ubuntu0.8+tuxcare.els1 0:2.31-0ubuntu9.18+tuxcare.els1 amd64 0:2.31-0ubuntu9.18+tuxcare.els1 amd64 0:1.1.1f-1ubuntu2.24+tuxcare.els2 0:1.1.1f-1ubuntu2.24+tuxcare.els2 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els10 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els10 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els11 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els11 amd64 0:2.64.6-1~ubuntu20.04.9+tuxcare.els1 0:2.64.6-1~ubuntu20.04.9+tuxcare.els1 amd64 0:2.64.6-1~ubuntu20.04.9+tuxcare.els2 0:2.64.6-1~ubuntu20.04.9+tuxcare.els2 amd64 0:8u482-ga~us1-0ubuntu1~20.04+tuxcare.els1 0:8u482-ga~us1-0ubuntu1~20.04+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els12 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els12 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els13 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els13 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els14 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els14 (^5\.4\.0\-(?:\d{4,}|[3-9]\d{2}|2[3-9]\d|22[5-9])\-tuxcare\.els(?:\d{2,}|[7-9])(\-\w*)?$) amd64 0:5.4.0-225.245 0:5.4.0-225.245 amd64 0:7.68.0-1ubuntu2.25+tuxcare.els1 0:7.68.0-1ubuntu2.25+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els15 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els15 amd64 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els1 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els16 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els16 amd64 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els17 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els17 amd64 0:2.4.41-4ubuntu3.23+tuxcare.els1 0:2.4.41-4ubuntu3.23+tuxcare.els1 0:9.0.31-1ubuntu0.9+tuxcare.els2 amd64 0:0.9.3-2ubuntu2.5+tuxcare.els3 0:0.9.3-2ubuntu2.5+tuxcare.els3 amd64 0:2.2.9-1ubuntu0.8+tuxcare.els2 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els18 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els18 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els19 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els19 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els20 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els20 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els21 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els21 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els22 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els22 amd64 1:8.2p1-4ubuntu0.13+tuxcare.els1 1:8.2p1-4ubuntu0.13+tuxcare.els1 (^5\.4\.0\-(?:\d{4,}|[3-9]\d{2}|2[3-9]\d|22[6-9])\-tuxcare\.els(?:\d{2,}|[8-9])(\-\w*)?$) amd64 0:5.4.0-226.246 0:5.4.0-226.246 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els23 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els23 amd64 0:2.34-6ubuntu1.11+tuxcare.els6 0:2.34-6ubuntu1.11+tuxcare.els6 amd64 0:4.10-1ubuntu1.13+tuxcare.els2 0:4.10-1ubuntu1.13+tuxcare.els2 (^5\.4\.0\-(?:\d{4,}|[3-9]\d{2}|2[3-9]\d|22[7-9])\-tuxcare\.els(?:\d{2,}|9)(\-\w*)?$) amd64 0:5.4.0-227.247 0:5.4.0-227.247 amd64 0:2.34-6ubuntu1.11+tuxcare.els7 0:2.34-6ubuntu1.11+tuxcare.els7 amd64 0:0.9.3-2ubuntu2.5+tuxcare.els4 0:0.9.3-2ubuntu2.5+tuxcare.els4 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els24 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els24 amd64 1:2.25.1-1ubuntu3.14+tuxcare.els2 1:2.25.1-1ubuntu3.14+tuxcare.els2 amd64 0:2.2.9-1ubuntu0.8+tuxcare.els3 amd64 0:3.6.13-2ubuntu1.12+tuxcare.els1 0:3.6.13-2ubuntu1.12+tuxcare.els1 amd64 0:2.4.41-4ubuntu3.23+tuxcare.els2 0:2.4.41-4ubuntu3.23+tuxcare.els2 amd64 0:2.3.1-9ubuntu1.9+tuxcare.els2 0:2.3.1-9ubuntu1.9+tuxcare.els2 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els25 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els25 amd64 1:8.2p1-4ubuntu0.13+tuxcare.els2 1:8.2p1-4ubuntu0.13+tuxcare.els2 0:9.0.31-1ubuntu0.9+tuxcare.els3 amd64 0:1.6.37-2+tuxcare.els2 amd64 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2 amd64 1:1.30.1-4ubuntu6.5+tuxcare.els1 1:1.30.1-4ubuntu6.5+tuxcare.els1 amd64 0:245.4-4ubuntu3.24+tuxcare.els2 amd64 0:4.10-1ubuntu1.13+tuxcare.els3 0:4.10-1ubuntu1.13+tuxcare.els3 amd64 0:1.1.1f-1ubuntu2.24+tuxcare.els3 0:1.1.1f-1ubuntu2.24+tuxcare.els3 amd64 0:11.0.30+7-0ubuntu1~20.04+tuxcare.els1 0:11.0.30+7-0ubuntu1~20.04+tuxcare.els1 amd64 0:245.4-4ubuntu3.24+tuxcare.els1 amd64 0:5.30.0-9ubuntu0.5+tuxcare.els1 0:5.30.0-9ubuntu0.5+tuxcare.els1 amd64 0:11.0.30+7-0ubuntu1~20.04+tuxcare.els2 0:11.0.30+7-0ubuntu1~20.04+tuxcare.els2 amd64 1:8.2p1-4ubuntu0.13+tuxcare.els3 1:8.2p1-4ubuntu0.13+tuxcare.els3 (^5\.4\.0\-(?:\d{4,}|[3-9]\d{2}|2[3-9]\d|22[8-9])\-tuxcare\.els(?:\d{2,})(\-\w*)?$) amd64 0:5.4.0-228.248 0:5.4.0-228.248 amd64 1:2.32-1ubuntu0.2+tuxcare.els1 0:2.7.18-1~20.04.7+tuxcare.els1 amd64 0:2.7.18-1~20.04.7+tuxcare.els1 amd64 0:0.9.3-2ubuntu2.5+tuxcare.els5 0:0.9.3-2ubuntu2.5+tuxcare.els5 0:4.93-13ubuntu1.12+tuxcare.els1 amd64 0:4.93-13ubuntu1.12+tuxcare.els1 amd64 0:2.4.41-4ubuntu3.23+tuxcare.els3 0:2.4.41-4ubuntu3.23+tuxcare.els3 (^5\.4\.0\-(?:\d{4,}|[3-9]\d{2}|2[3-9]\d|229)\-tuxcare\.els(?:\d{3,}|[2-9]\d|1[1-9])(\-\w*)?$) amd64 0:5.4.0-229.249 0:5.4.0-229.249 amd64 0:1.1.1f-1ubuntu2.24+tuxcare.els4 0:1.1.1f-1ubuntu2.24+tuxcare.els4 amd64 1:2.3.7.2-1ubuntu3.7+tuxcare.els1 1:2.3.7.2-1ubuntu3.7+tuxcare.els1 amd64 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els26 8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els26 amd64 0:7.4.3-4ubuntu2.29+tuxcare.els4 0:7.4.3-4ubuntu2.29+tuxcare.els4 amd64 0:3.6.13-2ubuntu1.12+tuxcare.els3 0:3.6.13-2ubuntu1.12+tuxcare.els3 0:3.4-6ubuntu0.1+tuxcare.els1 amd64 0:3.6.13-2ubuntu1.12+tuxcare.els4 0:3.6.13-2ubuntu1.12+tuxcare.els4 amd64 0:2.4.41-4ubuntu3.23+tuxcare.els4 0:2.4.41-4ubuntu3.23+tuxcare.els4