MGASA-2025-0324 - Updated python3 packages fix security vulnerabilities. MGASA-2025-0324 - Updated python3 packages fix security vulnerabilities Publication date: 09 Dec 2025 URL: https://advisories.mageia.org/MGASA-2025-0324.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-13836, CVE-2025-13837, CVE-2025-12084 Description: Excessive read buffering DoS in http.client. (CVE-2025-13836) Out-of-memory when loading Plist. (CVE-2025-13837) Quadratic complexity in node ID cache clearing. (CVE-2025-12084) References: - https://bugs.mageia.org/show_bug.cgi?id=34808 - https://www.openwall.com/lists/oss-security/2025/12/05/5 - https://www.cve.org/CVERecord?id=CVE-2025-13836 - https://www.cve.org/CVERecord?id=CVE-2025-13837 - https://www.cve.org/CVERecord?id=CVE-2025-12084 SRPMS: - 9/core/python3-3.10.18-1.5.mga9 . Updated python3 packages in Mageia resolve issues like excessive buffering and out-of-memory. Essential for stability.. python security, Mageia advisory, Denial of Service, security fix, software update. . Severity: Important. LinuxSecurity.com Team
* Fix scrolling issues in some sites having fixed background. * Fix prolonged buffering during progressive live playback. * Fix several crashes and rendering issues. * Security fixes: CVE-2022-42799, CVE-2022-42823, CVE-2022-42824. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-ce32af66d6 2022-11-09 11:20:02.682775 --------------------------------------------------------------------------------Name : webkit2gtk3 Product : Fedora 36 Version : 2.38.2 Release : 1.fc36 URL : https://www.webkitgtk.org/ Summary : GTK Web content engine library Description : WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3. --------------------------------------------------------------------------------Update Information: * Fix scrolling issues in some sites having fixed background. * Fix prolonged buffering during progressive live playback. * Fix several crashes and rendering issues. * Security fixes: CVE-2022-42799, CVE-2022-42823, CVE-2022-42824 --------------------------------------------------------------------------------ChangeLog: * Fri Nov 4 2022 Michael Catanzaro 2.38.2-1 - Update to 2.38.2 --------------------------------------------------------------------------------References: [ 1 ] Bug #2140511 - CVE-2022-42799 webkit2gtk3: webkitgtk: a issue was addressed with improved UI handling [fedora-36] https://bugzilla.redhat.com/show_bug.cgi?id=2140511 [ 2 ] Bug #2140517 - CVE-2022-42824 webkit2gtk3: webkitgtk: A logic issue was addressed with improved state management [fedora-36] https://bugzilla.redhat.com/show_bug.cgi?id=2140517 [ 3 ] Bug #2140523 - CVE-2022-42823 webkit2gtk3: webkitgtk: A type confusion issue was addressed with improved memory handling [fedora-36] https://bugzilla.redhat.com/show_bug.cgi?id=2140523 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-ce32af66d6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
# New in release OpenJDK 11.0.10 (2021-01-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-January/004689.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.10.txt ## Security fixes * JDK-8247619: Improve Direct Buffering of Characters ## Other changes * [JDK-8213821](https://bugs.openjdk.org/browse/JDK-8213821):. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-555c9aef71 2021-02-11 01:52:12.932949 --------------------------------------------------------------------------------Name : java-11-openjdk Product : Fedora 32 Version : 11.0.10.0.9 Release : 0.fc32 URL : https://openjdk.org/ Summary : OpenJDK 11 Runtime Environment Description : The OpenJDK 11 runtime environment. --------------------------------------------------------------------------------Update Information: # New in release OpenJDK 11.0.10 (2021-01-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-January/004689.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.10.txt ## Security fixes * JDK-8247619: Improve Direct Buffering of Characters ## Other changes * [JDK-8213821](https://bugs.openjdk.org/browse/JDK-8213821): -groupname Option Added to keytool Key Pair Generation e.g. `keytool -genkeypair -keyalg EC -groupname secp384r1` * [JDK-8248263](https://bugs.openjdk.org/browse/JDK-8248263): jarsigner Preserves POSIX File Permission and symlink Attributes * [JDK-8225764](https://bugs.openjdk.org/browse/JDK-8225764): Support for X25519 and X448 in TLS * OpenJDK now uses the system HarfBuzz installation instead of a bundled copy * Default to RSA when using keytool, as DSA is only supported by the LEGACY crypto policy. * SystemTap directories are correctly named on all supported architectures. * Class data sharing isnow supported on all architectures with a JIT (x86, x86_64, AArch64, ppc64, ppc64le, s390x, armv7hl) --------------------------------------------------------------------------------ChangeLog: * Mon Feb 1 2021 Andrew Hughes - 1:11.0.10.0.9-0 - Update to jdk-11.0.10.0+9 - Update release notes to 11.0.10.0+9 - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly. - Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags. - Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with RHEL version. - Drop JDK-8250861, JDK-8222286 & JDK-8254177 as applied upstream - Use system harfbuzz now this is supported. - Update tarball generation script to use PR3818 which handles JDK-8171279 changes - Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY - Adjust RH1842572 RSA default patch due to context change from JDK-8213400 - Following JDK-8005165, class data sharing can be enabled on all JIT architectures - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64) - Need to support noarch for creating source RPMs for non-scratch builds. - Include a test in the RPM to check the build has the correct vendor information. - Update build documentation to reflect this is java-11-openjdk, not java-1.8.0-openjdk - Cleanup debug package descriptions and version number placement. - Remove redundant closure and immediate reopening of include_normal_build block. - Fix location and comment differences from RHEL. - Introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched - Patch600 rh1750419-redhat_alt_java.patch amended to die, if it is used wrongly - Introduce ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures --------------------------------------------------------------------------------This update can be installed withthe "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-555c9aef71' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
# New in release OpenJDK 11.0.10 (2021-01-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-January/004689.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.10.txt ## Security fixes * JDK-8247619: Improve Direct Buffering of Characters ## Other changes * [JDK-8213821](https://bugs.openjdk.org/browse/JDK-8213821):. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-5dcdf8b2b1 2021-02-05 01:57:58.090764 --------------------------------------------------------------------------------Name : java-11-openjdk Product : Fedora 33 Version : 11.0.10.0.9 Release : 0.fc33 URL : https://openjdk.org/ Summary : OpenJDK 11 Runtime Environment Description : The OpenJDK 11 runtime environment. --------------------------------------------------------------------------------Update Information: # New in release OpenJDK 11.0.10 (2021-01-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-January/004689.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.10.txt ## Security fixes * JDK-8247619: Improve Direct Buffering of Characters ## Other changes * [JDK-8213821](https://bugs.openjdk.org/browse/JDK-8213821): -groupname Option Added to keytool Key Pair Generation e.g. `keytool -genkeypair -keyalg EC -groupname secp384r1` * [JDK-8248263](https://bugs.openjdk.org/browse/JDK-8248263): jarsigner Preserves POSIX File Permission and symlink Attributes * [JDK-8225764](https://bugs.openjdk.org/browse/JDK-8225764): Support for X25519 and X448 in TLS * OpenJDK now uses the system HarfBuzz installation instead of a bundled copy * Default to RSA when using keytool, as DSA is only supported by the LEGACY crypto policy. * SystemTap directories are correctly named on all supported architectures. * Class data sharing isnow supported on all architectures with a JIT (x86, x86_64, AArch64, ppc64, ppc64le, s390x, armv7hl) --------------------------------------------------------------------------------ChangeLog: * Mon Feb 1 2021 Andrew Hughes - 1:11.0.10.0.9-0 - Update to jdk-11.0.10.0+9 - Update release notes to 11.0.10.0+9 - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly. - Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags. - Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with RHEL version. - Drop JDK-8250861, JDK-8222286 & JDK-8254177 as applied upstream - Use system harfbuzz now this is supported. - Update tarball generation script to use PR3818 which handles JDK-8171279 changes - Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY - Adjust RH1842572 RSA default patch due to context change from JDK-8213400 - Following JDK-8005165, class data sharing can be enabled on all JIT architectures - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64) - Need to support noarch for creating source RPMs for non-scratch builds. - Include a test in the RPM to check the build has the correct vendor information. - Update build documentation to reflect this is java-11-openjdk, not java-1.8.0-openjdk - Cleanup debug package descriptions and version number placement. - Remove redundant closure and immediate reopening of include_normal_build block. - Fix location and comment differences from RHEL. - Introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched - Patch600 rh1750419-redhat_alt_java.patch amended to die, if it is used wrongly - Introduce ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures --------------------------------------------------------------------------------This update can be installed withthe "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-5dcdf8b2b1' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.