Linux Security Roundup for Week 36, 2025

Security 10907 Published 2025-09-07 09:18 by Philipp Esselbach

News

Here is a roundup of last week's security updates for various packages, including PostgreSQL, Python, HTTPD, OpenVPN, Libcommons-Lang-Java, and others. The distributions include AlmaLinux, Debian GNU/Linux, Fedora Linux, Oracle Linux, Red Hat Enterprise Linux, SUSE Linux, and Ubuntu Linux. The updates address various issues, such as memory leaks, out-of-bounds reads, low-severity CVEs, denial-of-service, or arbitrary code execution issues, to ensure the security and stability of the operating system.

AlmaLinux

The AlmaLinux Security team has released several updates to address vulnerabilities in various packages, including kernel and Python 3.9. The updates fix issues such as a double list add bug, an MMIO write access issue, and memory leaks in the kernel. In addition to the kernel update, other security patches have been issued for packages like PostgreSQL, mod_http2, httpd (Apache HTTP Server), pam (Pluggable Authentication Modules), and Linux-PAM.

Debian GNU/Linux

Debian has issued multiple security advisories to address vulnerabilities in various packages, including OpenVPN, Libcommons-Lang-Java, Ruby-Saml, and Node-Cipher-Base. Additionally, updates have been released for ClamAV, an antivirus utility for Unix, to fix two vulnerabilities that could lead to device crashes or arbitrary code execution. Other security updates include a patch for Chromium to address multiple vulnerabilities on Debian 12 and 13 systems. A new version of the wireless-regdb package has also been released for Debian 11 LTS, incorporating changes to radio regulations in several countries.

Fedora Linux

Security updates have been released for several packages on Fedora, including Docker-Buildx, Exiv2, Chromium, UDisks2, YQ, and Kea. The updates address various issues such as silent ABI changes, out-of-bounds reads, and low-severity CVEs to ensure the security and stability of the operating system. Updates have been made available for Fedora 41 and Fedora 42, covering a range of vulnerabilities across different packages.

Oracle Linux

Security updates have been released for Oracle Linux to address potential vulnerabilities in various packages, including PostgreSQL, Python, HTTPD, and UDisks2. The updates are classified as Important or Moderate due to their severity and cover different versions of the operating system. Multiple vulnerabilities have been addressed across multiple packages, including PostgreSQL (CVE-2025-8714 and CVE-2025-8715), Python (3.9, 3.11, and 3), and others like httpd, udisks2, pam, and kernel.

Red Hat Enterprise Linux

Red Hat has released several security updates to address vulnerabilities in various packages on Red Hat Enterprise Linux systems. The affected packages include PostgreSQL, krb5, python3, AIDE, httpd, kernel, and pam. Multiple versions of Red Hat Enterprise Linux (RHEL) have been updated with these patches, including RHEL 8 and RHEL 9.

SUSE Linux

Several security updates have been released for SUSE Linux systems to address critical and important vulnerabilities in various packages. The affected packages include git, python-future, jetty-minimal, nginx, rekor, libudisks2-0, traefik2, and others, with some classified as moderate or important. In addition to these updates, other security fixes have been made available for openSUSE systems, including patches for nvidia-open-driver-G06-signed and munge.

Ubuntu Linux

Ubuntu 14.04 LTS was updated to address security vulnerabilities found in Open VM Tools, which could allow a local attacker to simulate user inputs or set up a symlink attack to override files without authorization. Additionally, various other Ubuntu versions were affected by security notices for ImageMagick and the Linux kernel due to potential denial-of-service or arbitrary code execution issues. The updates also addressed vulnerabilities in KMail, RubyGems, PHP, Django, and FFmpeg. Multiple Ubuntu versions from 16.04 LTS to 25.04 were impacted by these security updates.

Debian GNU/Linux 13.1 Trixie Live Images released

PikaOS 25.09.06 is Now Available