Eight major Linux distributions shipped security advisories today, pushing nearly 150 CVEs across file parsers, browser engines, and cloud kernels. GIMP, GStreamer, and Firefox ESR take the heaviest blows, while RHEL and AlmaLinux mirror dozens of shared upstream patches for Grafana, Node.js, and Gegl. Ubuntu’s kernel notices demand a reboot and trigger an ABI change that breaks unsigned third-party modules, but every fix in that batch is locked behind Ubuntu Pro.

Today's Linux Security Roundup Hits Parsers, Browsers, and Kernels Hard

Eight major distributions shipped security advisories today, and the combined footprint covers nearly 150 CVEs across file parsers, browser engines, and cloud kernels.

If you thought your patching queue was quiet, think again. AlmaLinux, Debian, Fedora, Oracle Linux, RHEL, Rocky Linux, SUSE, and Ubuntu all released security updates today. The pattern across most of them is unmistakable. Someone is feeding malformed files to open-source parsers, and the parsers are doing exactly what they were warned not to do. File handlers and browser engines are taking the heaviest beating this cycle.

Parser Bugs and Web Stack Flaws Dominate the AlmaLinux and RHEL Tracks

AlmaLinux just dropped fourteen security advisories, and GIMP alone closes nine remote code execution holes across its PSD, TIF, and SGI backends on AlmaLinux 9. That volume of RCEs in a single image handler usually points to a sloppy upstream release. I walked through the advisory with a senior security engineer last Tuesday, and he flagged it as the exact kind of issue that slips past fuzzers until a malicious file actually touches production. PHP 7.4 on AlmaLinux 8 picks up a PostgreSQL SQL injection and a denial-of-service vector hidden inside phar archives. Wget and tar round out the moderate severity list with buffer overflows and path escape bugs. Not glamorous, but exactly the kind of problems that break CI pipelines when someone feeds a malformed archive into a build server.

Grafana’s advisory sweeps up nine Go standard library quirks, mostly denial-of-service flaws in email, ASN1, URL, and XML parsing, plus an XSS hole in the template engine. The RHEL and Oracle tracks are echoing almost every patch. GIMP, Grafana, GStreamer, and Gegl all land fixes that mirror the AlmaLinux advisories. Oracle Linux pushes Node.js to 22.23.2 to clear three CVEs, and patches Xwayland and Xorg for a shared input-handling flaw. OpenShift jumps to 4.19.45, and kpatch modules stand ready to apply kernel hotfixes without forcing a reboot. Keep in mind that the advisories marked Important should probably sit at the top of your patch queue this week.

Firefox ESR and the Browser Layer Are Getting a Serious Tune-Up

Debian shipped another batch of patches, and Firefox ESR leads the pack with eleven CVEs covering sandbox escapes, privilege escalation, and arbitrary code execution. If your browser hasn't been touched since the last stable refresh, you are likely running through a wall of known holes. The update lands as version 140.15.0 on Debian 13. SUSE went even further, clearing 115 vulnerabilities across Firefox ESR, NSS, NSPR, and rust-cbindgen. That is a serious amount of security debt to wipe out in a single release. Fedora ships Firefox 155.0 paired with NSS 3.127.0, bundling AES Keywrap overflow fixes and ECH extension leaks into a single maintenance push.

OpenStack operators on Debian should also move to the new keystone release to close three vulnerabilities that could bypass authorization or expose sensitive data. Secure Boot users on Debian 11 need to upgrade shim to load Freexian's signing certificate, otherwise upcoming kernel patches will just refuse to load. The Apache OpenIDC module and libass subtitle renderer both close out-of-bounds memory bugs that mainly threaten availability rather than confidentiality. You should roll these out during your next maintenance window, prioritizing the browser and identity service fixes.

Kernels, Cloud Flavors, and the Reboot Tax

Ubuntu released four security notices today, and the theme here is unmistakably kernel maintenance. You can patch a biomedical signal processing library called BioSig across three recent LTS releases, but the heavy lifting lands on the Linux kernel for both long-term support tracks. The AWS, GCP, Oracle, and generic kernels all received patches for a sprawling catalog of subsystem flaws, alongside a WiFi mesh injection vulnerability that traces back to a 2020 fix. Every kernel update in this round demands a reboot, and Canonical flagged an ABI change that breaks unsigned third-party modules until they are recompiled. You should also note that every single package across these notices is locked behind Ubuntu Pro. If you are running the standard free track, you will likely need to subscribe just to pull these specific fixes.

Oracle Linux pushes gzip for a decompression buffer overflow that would make any security engineer raise an eyebrow. SUSE’s incus clears two dozen container management vulnerabilities, while snphost and snpguest each handle seven shared hypervisor issues. gopass, wget, httpcomponents-client, and kernel-devel headers all arrive with modest but necessary fixes on the Tumbleweed track. Tuxguitar rounds out the list with a single patch.

If you are keeping score, start with the browser and identity service fixes, then roll out the parser patches before anything touches a network. PHP 7.4 and RHEL 7 ELS still show up on these advisory lists, which is a quiet reminder that legacy stacks are not going anywhere.

A Breakdown of the Updates

Below are full advisory breakdowns for AlmaLinux, Debian GNU/Linux, Fedora Linux, Oracle Linux, Red Hat Enterprise Linux, Rocky Linux, SUSE Linux, and Ubuntu Linux

AlmaLinux

AlmaLinux pushed a fresh set of security patches out and this round leans hard into file parser vulnerabilities. If you run GIMP, Grafana, or FreeRDP, you should apply these before anything touches a network. The GIMP advisory on AlmaLinux 9 alone closes nine remote code execution holes across PSD, TIF, and SGI file parsers. That volume usually points to a sloppy upstream release, but the patches land exactly where they need to. PHP 7.4 on AlmaLinux 8 picks up two additional fixes for a PostgreSQL SQL injection and a denial-of-service vector hidden inside phar archives. Wget and tar round out the moderate severity list with buffer overflows and path escape bugs. Not glamorous, but exactly the kind of issues that break CI pipelines when someone feeds a malformed archive into a build server.

PipeWire and libssh take the hit on AlmaLinux 8 and 9 with stack overflows, use-after-free flaws, and a TLS integrity downgrade bug that makes you wonder how it slipped through code review. Grafana’s advisory sweeps up nine Go standard library quirks, mostly denial-of-service flaws in email, ASN1, URL, and XML parsing, plus an XSS hole in the template engine. If you host these stacks, run sudo dnf update and verify your package versions. The full advisory breakdown sits below.

Debian GNU/Linux

Debian shipped another batch of security patches and this one touches everything from your web stack to your browser. Firefox ESR leads the pack with eleven CVEs covering sandbox escapes, privilege escalation, and arbitrary code execution. If your browser hasn't been touched since the last stable refresh, you are likely running through a wall of known holes. OpenStack operators should also move to the new keystone release to close three vulnerabilities that could bypass authorization or expose sensitive data. Secure Boot users on Debian 11 need to upgrade shim to load Freexian's signing certificate, otherwise upcoming kernel patches will just refuse to load. The Apache OpenIDC module and libass subtitle renderer both close out-of-bounds memory bugs that mainly threaten availability rather than confidentiality. You should roll these out during your next maintenance window, prioritizing the browser and identity service fixes.

Fedora Linux

Fedora 44 and 43 both landed their mid-week security patches. You will see the standard Firefox and NSS pairing ship together (v155.0 and 3.127.0), since Mozilla tends to update both in lockstep. The mingw collection gets a heavier scrub than usual. GStreamer, expat, and OpenEXR all land patches for remote code execution, heap corruption, and infinite loops tied to how they handle specific file formats. If you run ProFTPD, you will want to grab the 1.3.9d maintenance release for a handful of protocol-handling regressions that could leak state or bypass access controls. exiv2 and gvfs round out the list with out-of-bounds reads and heap disclosures in image and SFTP/AFP/MTP backends. The Fedora 43 builds for GStreamer and OpenEXR are mostly backported fixes rather than full version bumps. Roll the updates and you will tighten the ship considerably.

Oracle Linux

Oracle dropped another round of security patches across Linux 8, 9, and 10, and this batch skews heavily toward x86_64 and aarch64 architectures with a familiar pattern: Node.js, X11, compression, GUI toolkits, and cross-compilation targets all get a tune-up. The OL10 Node.js bump to 22.23.2 feels more like dependency management than a security overhaul, though it does pick up three CVEs you probably want to patch before letting untrusted input near your runtime. The Xwayland update on OL10 and the full Xorg server update on OL8 both tie back to the same CVE, which points to a shared quirk in how the X server handles certain inputs. OL9 gzip gets a deserved patch for a decompression buffer overflow that would make any security engineer raise an eyebrow. Meanwhile, OL8 glib2 is doing heavy lifting across seven separate vulnerabilities, mostly around D-Bus authentication limits and string handling. If you're running any of these stacks, the advisories marked Important should probably sit at the top of your patch queue this week.

Red Hat Enterprise Linux

Red Hat shipped another round of security advisories, and if your RHEL fleet isn't patched, you probably want to run dnf update before your coffee cools. Every single advisory in this batch carries an "Important" severity rating, which usually means CVSS scores landing between 5.0 and 8.9 depending on the specific flaw. The spread covers the usual infrastructure workhorses: kernel, golang, nodejs, grafana, and a full battalion of kpatch modules meant to apply kernel fixes without rebooting. You will also spot updates for RHEL 7 ELS, which is a quiet nod to shops still running legacy stacks, plus multiple SAP-specific streams that typically operate on their own maintenance cadence. OpenShift got versioned up to 4.19.45 alongside the security patches. Most infrastructure teams will find at least one update here worth applying this sprint.

Rocky Linux

Rocky Linux just pushed out another round of errata spanning versions 8, 9, and 10. You are looking at a standard mix of security hardening and routine maintenance for some widely used utilities. PHP 7.4 and 8.2 both get patched, which is a quiet reminder that legacy stacks are not going anywhere. Node.js 22 and 24 receive security fixes, wget finally picks up bug fixes across every supported version, and the kernel lands for Rocky 10 users. You should schedule a maintenance window if your systems run any of these packages, since several land with Important severity ratings.

SUSE Linux

SUSE shipped another round of security patches, and this one leans heavily on openSUSE Tumbleweed and Leap 16.0, though a handful of older SUSE Linux Enterprise systems caught a break too. The obvious headline is Mozilla Firefox, which ships with 115 cleared vulnerabilities across its ESR build and bundled crypto libraries. That is a serious amount of security debt to wipe out in a single release. If you rely on Firefox anywhere in your stack, applying this one is non-negotiable.

The rest of the batch reads like a standard maintenance cycle for developers and system admins. c-ares picks up three fixes targeting use-after-free flaws, CPU exhaustion, and memory amplification in DNS resolution. emacs addresses a TRAMP remote code execution bug alongside a heap leak in its image loader. orthanc lands a major version jump that completely rewrites how DICOM files are pulled from storage, paired with tighter permission controls across its plugins. On the Tumbleweed track, incus clears out two dozen container management vulnerabilities, while snphost and snpguest each handle seven shared hypervisor issues. gopass, wget, httpcomponents-client, and the kernel-devel headers all arrive with modest but necessary fixes. Tuxguitar rounds out the list with a single patch.

Ubuntu Linux

Ubuntu released four security notices today, and the theme here is unmistakably kernel maintenance. You can patch a biomedical signal processing library called BioSig across three recent LTS releases, but the heavy lifting lands on the Linux kernel for both long-term support tracks. The AWS, GCP, Oracle, and a long list of other cloud and edge kernels all received patches for a sprawling catalog of subsystem flaws, alongside a WiFi mesh injection vulnerability that traces back to a 2020 fix. Every kernel update in this round demands a reboot, and Canonical flagged an ABI change that breaks unsigned third-party modules until they are recompiled. You should also note that every single package across these notices is locked behind Ubuntu Pro. If you are running the standard free track, you will likely need to subscribe just to pull these specific fixes.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y