Several security issues were fixed in Valkey.
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in HTTP request smuggling, validation bypass or denial of service.
Multiple vulnerabilities were discovered in modules shipped with cpython 3.9, the primary interpreter for the Python programming language.
fix CVE-2024-56737, CVE-2025-56737, CVE-2025-1864 Fix CVE-2025-1744 and CVE-2025-1864
fix CVE-2024-56737, CVE-2025-56737, CVE-2025-1864 Fix CVE-2025-1744 and CVE-2025-1864
Several security issues were fixed in Alpine.
* bsc#1229640 * bsc#1231196 * bsc#1231204 * bsc#1233679 * bsc#1235452
* bsc#1228755 * bsc#1231196 * bsc#1231204 * bsc#1233679 * bsc#1235452
* bsc#1231204 * bsc#1233679 Cross-References: * CVE-2024-46818
* bsc#1229640 * bsc#1231204 * bsc#1233679 Cross-References:
https://security-tracker.debian.org/tracker/DSA-5881-1
* bsc#1237467 Cross-References: * CVE-2025-26618
* bsc#1228017 * bsc#1229640 * bsc#1231204 * bsc#1233679
* bsc#1233679 Cross-References: * CVE-2024-50302
* bsc#1229640 * bsc#1231204 * bsc#1233679 Cross-References:
https://security-tracker.debian.org/tracker/DSA-5879-1
FreeType could be made to crash or run programs if it opened a specially crafted font file.
* bsc#1239197 Cross-References: * CVE-2025-22868
* bsc#1239197 Cross-References: * CVE-2025-22868
Several security issues were fixed in X.Org X Server.
* jsc#PED-11136 Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6
https://security-tracker.debian.org/tracker/DSA-5880-1
An update that fixes one vulnerability is now available.
An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files which may result in arbitrary code execution. References:
patchlevel 1202 Security fix for CVE-2025-29768
Latest maintenance release from 7.1 branch. Changelog: https://github.com/FFmpeg/FFmpeg/blob/n7.1.1/Changelog . Contains backported fix for CVE-2025-22921.
Update to upstream 20250311: amdgpu: many firmware updates qcom: Update gpu firmwares for qcs8300 chipset add firmware for qat_420xx devices amdgpu: DMCUB updates for various ASICs
New freetype packages are available for Slackware 15.0 to fix a security issue.
Update to 134.0.6998.88 High CVE-2025-1920: Type Confusion in V8 High CVE-2025-2135: Type Confusion in V8 Medium CVE-2025-2136: Use after free in Inspector Medium CVE-2025-2137: Out of bounds read in V8
deadlock potential with VT-d and legacy PCI device pass-through [XSA-467, CVE-2025-1713]
Update to 134.0.6998.88 High CVE-2025-1920: Type Confusion in V8 High CVE-2025-2135: Type Confusion in V8 Medium CVE-2025-2136: Use after free in Inspector Medium CVE-2025-2137: Out of bounds read in V8
Update to upstream 20250311: amdgpu: many firmware updates qcom: Update gpu firmwares for qcs8300 chipset add firmware for qat_420xx devices amdgpu: DMCUB updates for various ASICs
This release addresses CVEs: CVE-2025-27835, CVE-2025-27832, CVE-2025-27831, CVE-2025-27836, CVE-2025-27830, CVE-2025-27833, CVE-2025-27837, CVE-2025-27834 The 10.05.0 release deprecates the non-standard operator “selectdevice”, all code should now be using the standard “setpagedevice” operator.
In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the heap. This at least causes the program to segmentation abort if the heap size parameter isn’t aligned correctly. In versions before GLIBC version 2.29 and if aligned correctly, it allows arbitrary writes […]
* bsc#1233307 Cross-References: * CVE-2024-11168
* bsc#1202848 * bsc#1215945 * bsc#1223070 * bsc#1223235 * bsc#1223256
* bsc#1238702 Cross-References: * CVE-2025-22870
* bsc#1215420 * bsc#1224700 * bsc#1224763 * bsc#1225742 * bsc#1231847
https://security-tracker.debian.org/tracker/DSA-5878-1
