# changelog

author: qinxue <qinxue6@h-partners.com> - 1:1.44.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mptcp fix error handling rp_filter when kernel don't support mptcp


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.44.2-4.kb4
changelog:
  - sync NetworkManager 1.44.2-7 from openEuler 24.03 LTS SP3 (f:163894)
  - fix CVE-2026-10805 (v:163894)[CVE-2026-10805]
  - drop ioctl fallback for finding veth's peer (f:163894)
  - fix CVE-2025-9615 (v:163894)[CVE-2025-9615]


author: Funda Wang <fundawang@yeah.net> - 5.3.1-10
changelog:
  - Type:CVE
  - CVE:CVE-2025-2751 CVE-2025-3158 CVE-2025-3196
  - SUG:NA
  - DESC:fix CVE-2025-2751 CVE-2025-3158 CVE-2025-3196


author: mapengyuan <mapengyuan@xfusion.com> - 5.3.1-16
changelog:
  - Type:CVE
  - CVE:CVE-2025-2754 CVE-2025-2756 CVE-2025-5200
  - SUG:NA
  - DESC:fix CVE-2025-2754 CVE-2025-2756 CVE-2025-5200


author: majianhan <majianhan@kylinos.cn> - 5.3.1-17
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204


author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-3
changelog:
  - Type:CVE
  - CVE:CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076
  - SUG:NA
  - DESC:fix CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076


author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-4
changelog:
  - Type:CVE
  - CVE:CVE-2024-11187,CVE-2024-12705
  - SUG:NA
  - DESC:fix CVE-2024-111878 and CVE-2024-12705


author: tangce<tangce1@huawei.com> - 32:9.18.21-5
changelog:
  - Type:CVE
  - CVE:CVE-2025-8677,CVE-2025-40778,CVE-2025-40780
  - SUG:NA
  - DESC:fix CVE-2025-8677,CVE-2025-40778,CVE-2025-40780


author: tangce <tangce1@h-partners.com> - 32:9.18.21-9
changelog:
  - Type:CVE
  - CVE:CVE-2026-3039,CVE-2026-3592,CVE-2026-5946
  - SUG:NA
  - DESC:fix CVE-2026-3039,CVE-2026-3592,CVE-2026-5946


author: Funda Wang <fundawang@yeah.net> - 2.41-14
changelog:
  - Fix CVE-2024-57360: nm: Avoid potential segmentation fault when displaying
    symbols without version info.
  - Fix CVE-2025-0840: stack-buffer-overflow at objdump disassemble_bytes


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 2.41-17.kb4
changelog:
  - sync binutils 2.41-29 from openEuler 24.03 LTS (f:141842)
  - Fix CVE-2026-3441, CVE-2026-3442 (v:141842)[CVE-2026-3441,CVE-2026-3442]
  - Fix CVE-2025-11412 (v:141842)[CVE-2025-11412]
  - Bump to release 27 (f:141842)
  - Bump to release 26 (f:141842)
  - Backport patch from trunk to 2.41 (f:141842)
  - Fix CVE-2025-5244, CVE-2025-5245 (v:141842)[CVE-2025-5244,CVE-2025-5245]
  - Bump to 2.41-23 (f:141842)
  - Format patch names (f:141842)
  - Sync openEuler 24.03 series and master branch's CVE and bugfix patches (f:141842)
  - Fix CVE-2025-7545 (v:141842)[CVE-2025-7545]
  - fix cve-2025-7456 (v:141842)[CVE-2025-7456]


author: jianmin <jianmin@iscas.ac.cn> - 1.34.1-5
changelog:
  - Type:cve
  - CVE:CVE-2024-3727 CVE-2024-24791
  - SUG:NA
  - DESC: fix CVE-2024-3727 and Rebuild to fix CVE-2024-24791


author: liaowei <liaowei@kylinsec.com.cn> - 1.34.1-10.kb2
changelog:
  - sync buildah 1.34.1-12 from openEuler 24.03 LTS (f:156486)
  - backport CVE-2024-9676 CVE-2025-47913 (f:156486)


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1.18.0-2
changelog:
  - Type:CVE
  - ID:CVE-2025-50422
  - SUG:NA
  - DESC:Fix a NULL access in active_edges_to_traps()
         Add unlikely() to test for x == INT32_MAX for the NULL reference


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1:1.1.1m-13.kb4
changelog:
  - sync compat-openssl11 1.1.1m-18 from openEuler 24.03 LTS (f:156524)
  - add sw64 support (f:156524)
  - fix CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390 (v:156524)[CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390]
  - fix CVE-2026-22796,CVE-2026-22795,CVE-2025-69419,CVE-2025-68160,CVE-2025-69421,CVE-2025-69420 (v:156524)[CVE-2026-22796,CVE-2026-22795,CVE-2025-69419,CVE-2025-68160,CVE-2025-69421,CVE-2025-69420]
  - fix CVE-2025-69418 (v:156524)[CVE-2025-69418]
  - fix CVE-2025-9230 (v:156524)[CVE-2025-9230]


author: xiaojian <xiaojian@kylinsec.com.cn> - 1:1.1.1m-18.kb2
changelog:
  - sync compat-openssl11 1.1.1m-19 from openEuler 24.03 LTS SP3 (f:162209)
  - fix CVE-2026-42766 CVE-2026-34180 CVE-2026-45447 CVE-2026-7383 CVE-2026-9076 (v:162209)[CVE-2026-42766,CVE-2026-34180,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076]


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1.6.22-16.kb2
changelog:
  - sync containerd 1.6.22-29 from openEuler 24.03 LTS SP3 (f:165430)
  - fix CVE-2026-47262 and CVE-2026-53488 (v:165430)[CVE-2026-47262,CVE-2026-53488]
  - bump version for using golang update for bugfix (f:165430)
  - rebuild for the golang version with the CVE fixed (f:165430)
  - backport some patches (f:165430)
  - fix CVE-2024-25621 and CVE-2025-64329 (v:165430)[CVE-2024-25621,CVE-2025-64329]
  - fix userns with Dockerfile VOLUME mounts that need copy (f:165430)
  - Fix ctr snapshot mount produce invalid mount command for empty option. (f:165430)
  - fix: Remove `LimitNOFILE` from `containerd.service` (f:165430)
  - fix dead loop (f:165430)
  - delete task asynchronously to avoid containerd be killed when delete is blocking (f:165430)
  - execute delayKill when fd is exhausted (f:165430)
  - do not report error log when skip otlp plugin (f:165430)
  - sync some patches from upstream (f:165430)


author: wang zhijiang <wangzhijiang@kylinsec.com.cn> - 1.8.7-2.kb2
changelog:
  - sync crun 1.8.7-3 from openEuler 24.03 LTS SP2 (f:156738)
  - Fix CVE-2025-24965 (v:156738)[CVE-2025-24965]


author: xinghe <xingheyd@163.com> - 4.19.3-9
changelog:
  - Type:cves
  - ID:CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408
  - SUG:NA
  - DESC:fix CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408


author: Funda Wang <fundawang@yeah.net> - 1:2.4.7-7
changelog:
  - fix CVE-2025-58060, CVE-2025-58364
  - move www files into main package due to requirement by web interface


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         h3: fix query of concurrent streams
         noproxy: fix the IPV6 network mask pattern match
         krb5_gssapi: fix memory leak on error path
         openldap: fix memory-leak in error path
         conn: fix hostname move on connection reuse 
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes
         openssl: fix a potential memory leak of params.cert


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:urlapi: avoid null deref if setting blank host to url
         urlapi: skip appending NULL pointer query


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:formdata: validate callback is non-NULL before use
         tftp: correct the filename length check


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-28
changelog:
  - Type:CVE
  - CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
  - SUG:NA
  - DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-29
changelog:
  - Type:CVE
  - CVE:CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168
  - SUG:NA
  - DESC:fix CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168


author: lingsheng <lingsheng1@h-partners.com> - 2.90-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         cache: Fix potential NULL deref in arcane situations.
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         allow binding mac with ip6


author: Liu Qingtao <liu.qingtao2@zte.com.cn> - 2.90-5
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:Ignore Wincompatible-pointer-types error when compiling with gcc-14.3


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix bounds checking in check_ia()
         Fix SEGV in Dbus code
         More fixes for DHCP ops in Dbus when DHCP not configured


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-9
changelog:
  - Type:CVE
  - CVE:CVE-2026-4890 CVE-2026-4891 CVE-2026-4892 CVE-2026-4893 CVE-2026-5172
  - SUG:NA
  - DESC:Fix NSEC bitmap parsing infinite loop
         Verify rdlen field in RRSIG packets
         Fix buffer overflow in helper.c with large CLIDs
         Fix broken client subnet validation
         Fix buffer overflow vulnerability in extract_addresses()


author: wangkai <13474090681@163.com> - 1:2.3.20-4
changelog:
  - Fix CVE-2025-59031, CVE-2025-59032, CVE-2026-27855, CVE-2026-27856,
    CVE-2026-27857, CVE-2026-27858, CVE-2026-27859, CVE-2026-0394


author: wangkai <13474090681@163.com> - 128.11.0-1
changelog:
  - Update to 128.11.0
  - Fix MFSA-TMP-2025-0001: Double-free in libvpx encoder
  - Fix CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269


author: wangkai <13474090681@163.com> - 128.13.0-1
changelog:
  - Update to 128.13.0
  - Fix CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032
    CVE-2025-8033 CVE-2025-8034 CVE-2025-8035


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 128.14.0-1.kb1
changelog:
  - Update resource URLs for newtab page (b:24719)
  - New translation of open the profile manager.(b:47784)
  - Change the logo of openeuler to KylinSec.(f:39662)
  - Change the official website address of the first startup.(b:49674)
  - Modify home page (f:54944)


author: puhongyu <puhongyu@kylinsec.com.cn> - 140.11.0-1.kb1
changelog:
  - sync firefox 140.11.0-1 from openEuler 24.03 LTS (f:156506)
  - update to 140.11.0 (f:156506)
  - update to 140.10.2 (fix CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8094) (v:156506)[CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8094]
  - update to 140.10.1 (fix CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, CVE-2026-7323) (v:156506)[CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, CVE-2026-7323]
  - update to 140.10.0 (f:156506)
  - update to 140.9.1 (fix CVE-2026-5731, CVE-2026-5732, CVE-2026-5734) (v:156506)[CVE-2026-5731, CVE-2026-5732, CVE-2026-5734]
  - update to 140.9.0 (f:156506)
  - update to 140.8.0 (f:156506)
  - update to 140.7.0 (fix CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,CVE-2026-0891) (v:156506)[CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,CVE-2026-0891]
  - update to 140.6.0 (f:156506)
  - BuildRequires(cargo) add version constraint (f:156506)


author: zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload related ko when stopping firewalld service
         To reduce unnecessary loading of ebtables-related kernel modules
         fix(nm): release NM client after a timeout


author: lishengsong <lishengsong@kylinsec.com.cn> - 1.2.6-7.kb1
changelog:
  - Fixed the issue where the authentication window pulled up by the firewall command had an English prompt(f:125539)


author: zhengwei <zhengwei@zhengwei@kylinsec.com.cn> - 1.2.6-7.kb2
changelog:
  - sync firewalld 1.2.6-8 from openEuler 24.03 LTS (f:141929)
  - fix CVE-2026-4948 (v:141929)[CVE-2026-4948]
  - fix(icmp): fix check_icmpv6_name() to use correct IPv6 names (f:141929)
  - fix broken symbolic link after package remove (f:141929)


author: Wang Qi <wangqi@kylinsec.com.cn> - 1.10.2-10.kb1
changelog:
  - rw bind app and add default remote. (b:41058)
  - add provides flatpak-lib for install gnome-software. (f:38372)


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1.10.2-10.kb2
changelog:
  - sync flatpak 1.10.2-12 from openEuler 24.03 LTS SP3 (f:161512)
  - Fix CVE-2026-34079 (v:161512)[CVE-2026-34079]
  - Fix CVE-2026-34078 (v:161512)[CVE-2026-34078]


author: wangkai <13474090681@163.com> - 2:2.11.8-1
changelog:
  - Update to 2.11.8
  - Fix CVE-2026-22852, CVE-2026-22856, CVE-2026-22859, CVE-2026-23530, CVE-2026-23531,
    CVE-2026-23532, CVE-2026-23534, CVE-2026-24491, CVE-2026-24675, CVE-2026-24676,
    CVE-2026-24679, CVE-2026-24681, CVE-2026-24682, CVE-2026-24683, CVE-2026-24684,
    CVE-2026-25997, CVE-2026-26271, CVE-2026-26986, CVE-2026-27015, CVE-2026-25941,
    CVE-2026-22855, CVE-2026-22857, CVE-2026-23533, CVE-2026-23732, CVE-2026-23883,
    CVE-2026-23884


author: wangkai <13474090681@163.com> - 2:2.11.8-3
changelog:
  - Fix CVE-2026-26955, CVE-2026-26965, CVE-2026-31806, CVE-2026-31883, CVE-2026-31885,
    CVE-2026-33984, CVE-2026-33983


author: wangkai <13474090681@163.com> - 2:2.11.8-5
changelog:
  - Fix CVE-2026-25942, CVE-2026-25952, CVE-2026-25953, CVE-2026-25954, CVE-2026-27951,
    CVE-2026-29774, CVE-2026-29775, CVE-2026-31884, CVE-2026-33985


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 14.1-8.kb3
changelog:
  - sync gdb 14.1-11 from openEuler 24.03 LTS SP2 (f:156777)
  - fix CVE-2025-11840 (v:156777)[CVE-2025-11840]
  - fix CVE-2025-11412 (v:156777)[CVE-2025-11412]
  - fix CVE-2025-11083 (v:156777)[CVE-2025-11083]


author: yaoxin <yao_xin001@hoperun.com> - 0.4.50-1
changelog:
  - Update to 0.4.50:
  - Core:
    * Better Gobject Introspection annotation coverage.
    * Improved error handling for gegl chain processing.
    * Added accessors for pad meta-data, to be able to show names and descriptions in UIs.
    * GeglColor: more lax parameters for g_arapm_values_cmp
    * exr-save: store 16bpc files as half, fixing gimp#10778
    * ff-load, ff-save: fix build with FFmpeg 7
    * dither: do processing in linear when all levels==2


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: yefeng <yefeng@kylinsec.com.cn> - 2:3.0.2-4.kb1
changelog:
  - update to version 3.0.2-4.kb1 (f:109480)
  - Fix CVE-2025-10920, CVE-2025-10922, CVE-2025-10923, CVE-2025-10924 and CVE-2025-10925 (v:109480)[CVE-2025-10920][CVE-2025-10922][CVE-2025-10923][CVE-2025-10924][CVE-2025-10925]
  - Fix CVE-2025-6035 (v:109480)[CVE-2025-6035]
  - Fix CVE-2025-5473 (v:109480)[CVE-2025-5473]
  - Fix CVE-2025-2761 (v:109480)[CVE-2025-2761]


author: zhangxiaoqi <zhangxiaoqi@kylinsec.com.cn> - 2:3.0.2-4.kb3
changelog:
  - sync patchfile from openEuler 24.03 LTS SP2(f:131294)
  - modify Epoch same as openEuler 24.03 LTS SP2(f:131294)


author: XiaoWen <xiaowen@kylinsec.com.cn> - 2:3.0.2-4.kb4
changelog:
  - Fix CVE-2026-40915 and CVE-2026-40917 (v:141898)[CVE-2026-40915,CVE-2026-40917]
  - Fix CVE-2026-4150, CVE-2026-4151, CVE-2026-4153 and CVE-2026-4154 (v:156701)[CVE-2026-4150,CVE-2026-4151,CVE-2026-4153,CVE-2026-4154]


author: fuanan <fuanan3@h-partners.com> - 2.43.0-4
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: fuanan <fuanan3@h-partners.com> - 2.43.0-7
changelog:
  - Type:CVE
  - ID:CVE-2025-48384 CVE-2025-48385 CVE-2025-48386
  - SUG:NA
  - DESC:Fix CVE-2025-48384 CVE-2025-48385 CVE-2025-48386


author: fuanan <fuanan3@h-partners.com> - 2.43.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix malformed patch:
         backport-CVE-2025-48385-bundle-uri-fix-arbitrary-file-writes-via-parameter-i.patch


author: fuanan <fuanan3@h-partners.com> - 2.43.0-9
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-27614 CVE-2025-46334 CVE-2025-46835
  - SUG:NA
  - DESC:Fix CVE-2025-27613 CVE-2025-27614 CVE-2025-46334 CVE-2025-46835


author: fuanan <fuanan3@h-partners.com> - 2.43.0-10
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch
         config.mak.uname: set CSPRNG_METHOD to getrandom on Linux


author: Linux_zhang <244695981@qq.com> - 3.8.2-13
changelog:
  - fix CVE-2026-33846,CVE-2026-3833,CVE-2026-42009,CVE-2026-42010,CVE-2026-42014,CVE-2026-42015,CVE-2026-5260.


author: puhongyu <puhongyu@kylinsec.com.cn> - 1.21.4-37.kb3
changelog:
  - sync golang 1.21.4-44 from openEuler 24.03 LTS (f:156548)
  - fix CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140 (v:156548)[CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140]
  - fix CVE-2026-27139,CVE-2026-27142,CVE-2026-25679 (v:156548)[CVE-2026-27139,CVE-2026-27142,CVE-2026-25679]


author: mazhiguo <mazhiguo@kylinsec.com.cn> - 1:2.12-40.kb1
changelog:
  - Subject: [PATCH 1/2] cryptodisk: add OS provided secret support (f:109597)
  - Subject: [PATCH] newfeature: tpcm: add tpcm support (f:109597)
  - Subject: [PATCH 2/2] efi: Add API for retrieving the EFI secret for cryptodisk (f:109597)
  - Subject: [PATCH] blscfg: add blscfg module to parse Boot Loader Specification (f:109597)
  - Subject: [PATCH] Add BLS support to grub-mkconfig (f:109597)
  - Subject: [PATCH] Add grub2-switch-to-blscfg (f:109597)
  - Subject: [PATCH] 10_linux: fix missing "ro" in kernel boot parameters (f:109597)
  - Subject: [PATCH 01/73] misc: Implement grub_strlcpy() (f:109597)
  - Subject: [PATCH 02/73] fs/ufs: Fix a heap OOB write (f:109597)
  - Subject: [PATCH 03/73] fs/hfs: Fix stack OOB write with grub_strcpy() (f:109597)
  - Subject: [PATCH 04/73] fs/tar: Initialize name in grub_cpio_find_file() (f:109597)
  - Subject: [PATCH 05/73] fs/tar: Integer overflow leads to heap OOB write (f:109597)
  - Subject: [PATCH 06/73] fs/f2fs: Set a grub_errno if mount fails (f:109597)
  - Subject: [PATCH 07/73] fs/hfsplus: Set a grub_errno if mount fails (f:109597)
  - Subject: [PATCH 08/73] fs/iso9660: Set a grub_errno if mount fails (f:109597)
  - Subject: [PATCH 09/73] fs/iso9660: Fix invalid free (f:109597)
  - Subject: [PATCH 10/73] fs/jfs: Fix OOB read in jfs_getent() (f:109597)
  - Subject: [PATCH 11/73] fs/jfs: Fix OOB read caused by invalid dir slot index (f:109597)
  - Subject: [PATCH 12/73] fs/jfs: Use full 40 bits offset and address for a data (f:109597)
  - Subject: [PATCH 13/73] fs/jfs: Inconsistent signed/unsigned types usage in (f:109597)
  - Subject: [PATCH 14/73] fs/ext2: Fix out-of-bounds read for inline extents (f:109597)
  - Subject: [PATCH 15/73] fs/ntfs: Fix out-of-bounds read (f:109597)
  - Subject: [PATCH 16/73] fs/ntfs: Track the end of the MFT attribute buffer (f:109597)
  - Subject: [PATCH 17/73] fs/ntfs: Use a helper function to access attributes (f:109597)
  - Subject: [PATCH 18/73] fs/ntfs: Implement attribute verification (f:109597)
  - Subject: [PATCH 19/73] fs/xfs: Fix out-of-bounds read (f:109597)
  - Subject: [PATCH 20/73] fs/xfs: Ensuring failing to mount sets a grub_errno (f:109597)
  - Subject: [PATCH 21/73] kern/file: Ensure file->data is set (f:109597)
  - Subject: [PATCH 22/73] kern/file: Implement filesystem reference counting (f:109597)
  - Subject: [PATCH 23/73] disk/cryptodisk: Require authentication after TPM unlock for (f:109597)
  - Subject: [PATCH 24/73] disk/loopback: Reference tracking for the loopback (f:109597)
  - Subject: [PATCH 25/73] kern/disk: Limit recursion depth (f:109597)
  - Subject: [PATCH 26/73] kern/partition: Limit recursion in part_iterate() (f:109597)
  - Subject: [PATCH 27/73] script/execute: Limit the recursion depth (f:109597)
  - Subject: [PATCH 28/73] net: Unregister net_default_ip and net_default_mac variables (f:109597)
  - Subject: [PATCH 29/73] net: Remove variables hooks when interface is (f:109597)
  - Subject: [PATCH 30/73] net: Fix OOB write in grub_net_search_config_file() (f:109597)
  - Subject: [PATCH 31/73] net/tftp: Fix stack buffer overflow in tftp_open() (f:109597)
  - Subject: [PATCH 32/73] video/readers/jpeg: Do not permit duplicate SOF0 (f:109597)
  - Subject: [PATCH 33/73] kern/dl: Fix for an integer overflow in grub_dl_ref() (f:109597)
  - Subject: [PATCH 34/73] fs/ext2: Rework out-of-bounds read for inline and external (f:109597)
  - Subject: [PATCH 35/73] kern/dl: Check for the SHF_INFO_LINK flag in (f:109597)
  - Subject: [PATCH 36/73] commands/extcmd: Missing check for failed allocation (f:109597)
  - Subject: [PATCH 37/73] commands/ls: Fix NULL dereference (f:109597)
  - Subject: [PATCH 38/73] commands/pgp: Unregister the "check_signatures" hooks (f:109597)
  - Subject: [PATCH 39/73] normal: Remove variables hooks on module unload (f:109597)
  - Subject: [PATCH 40/73] gettext: Remove variables hooks on module unload (f:109597)
  - Subject: [PATCH 41/73] gettext: Integer overflow leads to heap OOB write or (f:109597)
  - Subject: [PATCH 42/73] gettext: Integer overflow leads to heap OOB write (f:109597)
  - Subject: [PATCH 43/73] commands/read: Fix an integer overflow when supplying (f:109597)
  - Subject: [PATCH 44/73] commands/test: Stack overflow due to unlimited (f:109597)
  - Subject: [PATCH 45/73] commands/minicmd: Block the dump command in lockdown (f:109597)
  - Subject: [PATCH 46/73] commands/memrw: Disable memory reading in lockdown mode (f:109597)
  - Subject: [PATCH 47/73] commands/hexdump: Disable memory reading in lockdown (f:109597)
  - Subject: [PATCH 48/73] fs/bfs: Disable under lockdown (f:109597)
  - Subject: [PATCH 49/73] fs: Disable many filesystems under lockdown (f:109597)
  - Subject: [PATCH 50/73] disk: Use safe math macros to prevent overflows (f:109597)
  - Subject: [PATCH 51/73] disk: Prevent overflows when allocating memory for (f:109597)
  - Subject: [PATCH 52/73] disk: Check if returned pointer for allocated memory is (f:109597)
  - Subject: [PATCH 53/73] disk/ieee1275/ofdisk: Call grub_ieee1275_close() when (f:109597)
  - Subject: [PATCH 54/73] fs: Use safe math macros to prevent overflows (f:109597)
  - Subject: [PATCH 55/73] fs: Prevent overflows when allocating memory for arrays (f:109597)
  - Subject: [PATCH 56/73] fs: Prevent overflows when assigning returned values (f:109597)
  - Subject: [PATCH 57/73] fs/zfs: Use safe math macros to prevent overflows (f:109597)
  - Subject: [PATCH 58/73] fs/zfs: Prevent overflows when allocating memory for (f:109597)
  - Subject: [PATCH 59/73] fs/zfs: Check if returned pointer for allocated memory (f:109597)
  - Subject: [PATCH 60/73] fs/zfs: Add missing NULL check after grub_strdup() call (f:109597)
  - Subject: [PATCH 61/73] net: Use safe math macros to prevent overflows (f:109597)
  - Subject: [PATCH 62/73] net: Prevent overflows when allocating memory for (f:109597)
  - Subject: [PATCH 63/73] net: Check if returned pointer for allocated memory is (f:109597)
  - Subject: [PATCH 64/73] fs/sfs: Check if allocated memory is NULL (f:109597)
  - Subject: [PATCH 65/73] script/execute: Fix potential underflow and NULL (f:109597)
  - Subject: [PATCH 66/73] osdep/unix/getroot: Fix potential underflow (f:109597)
  - Subject: [PATCH 67/73] misc: Ensure consistent overflow error messages (f:109597)
  - Subject: [PATCH 68/73] bus/usb/ehci: Define GRUB_EHCI_TOGGLE as grub_uint32_t (f:109597)
  - Subject: [PATCH 69/73] normal/menu: Use safe math to avoid an integer overflow (f:109597)
  - Subject: [PATCH 70/73] kern/partition: Add sanity check after grub_strtoul() (f:109597)
  - Subject: [PATCH 71/73] kern/misc: Add sanity check after grub_strtoul() call (f:109597)
  - Subject: [PATCH 72/73] loader/i386/linux: Cast left shift to grub_uint32_t (f:109597)
  - Subject: [PATCH 73/73] loader/i386/bsd: Use safe math to avoid underflow (f:109597)
  - Subject: [PATCH] lib/libtasn1: Fix ETYPE_OK off by one array size check (f:109597)
  - Subject: [PATCH] Export all variables from the initial context when creating a (f:109597)
  - Subject: [PATCH] acpi: Fix out of bounds access in grub_acpi_xsdt_find_table() (f:109597)
  - Subject: [PATCH] commands/efi/tpm: Re-enable measurements on confidential (f:109597)
  - Subject: [PATCH] commands/legacycfg: Avoid closing file twice (f:109597)
  - Subject: [PATCH] disk/mdraid1x_linux: Prevent infinite recursion (f:109597)
  - Subject: [PATCH] fix CVE-2024-56738 (f:109597)
  - Subject: [PATCH] fix not verifying grub.cfg when loading it (f:109597)
  - Subject: [PATCH] fix bug about petitboot doesn't ignore EFI entries for (f:109597)
  - Subject: [PATCH 2/5] sw64: Add Linux load logic (f:109597)
  - Subject: [PATCH 4/5] sw64: Add auxiliary files (f:109597)
  - Subject: [PATCH 3/5] sw64: Add awareness for SW64 reloations (f:109597)
  - Subject: [PATCH 1/5] sw64: Add early startup code (f:109597)
  - Subject: [PATCH 5/5] sw64: Add to build system (f:109597)
  - Subject: [PATCH] LoongArch: bugfix: clear buffer for screen info (f:109597)


author: mazhiguo <mazhiguo@kylinsec.com.cn> - 1:2.12-40.kb2
changelog:
  - fix backspace in username prompt (f:56805)
  - add text grub entry (f:56641)
  - fix simplify standard and rescue system title (f:106723)
  - fix solve the problem of incorrect display of the se (f:106723)
  - optimize backup and restore configuration files (f:106723)
  - Add trusted integrity measurement feature (f:31781)
  - support trusted integrity measurement feature on loongarch64 (f:31781)


author: mazhiguo <mazhiguo@kylinsec.com.cn> - 1:2.12-40.kb7
changelog:
  - sync grub2 2.12-47 from openEuler 24.03 LTS SP2 (f:108264)
  - commands/usbtest: Ensure string length is sufficient in usb string processing (v:108264)[CVE-2025-61661,CVE-2025-61662,CVE-2025-54771,CVE-2025-54770,CVE-2025-61663,CVE-2025-61664]
  - SW64: Enable GRUB EFI build support for sw_64 architecture (f:108264)
  - kern/riscv/efi/init: Use time register in grub_efi_get_time_ms() (f:108264)
  - fs/btrfs: Fix memory leaks (f:108264)
  - i386: Check for cpuid family when flush cache only on VIA CPUs (f:108264)
  - Revert 'grub-install: bailout root device probing' (f:108264)
  - Clear buffer for screen info (f:108264)
  - drop duplicate list of locale files (f:108264)
  - fix CVE-2024-56738 (v:108264)[CVE-2024-56738]
  - adds SW64 to the GRUB build system and various tools (f:108264)
  - add helper functions of memory, cache, timer, etc support for SW64 arch (f:108264)
  - add awareness of SW64 relocations throughout the grub tools and elf->PE relocation conversion support (f:108264)
  - add support running Linux underneath as UEFI payload for SW64 arch (f:108264)
  - add SW64 early startup code (f:108264)
  - fix the vulnerabilities announced on February 18th, 2025 (v:108264)[CVE-2024-45781,CVE-2024-45782,CVE-2024-56737,CVE-2024-45780,CVE-2024-45783,CVE-2024-49504,CVE-2025-0624]
  - disable fortify level based on new settings of openEuler-rpm-config (f:108264)
  - fix not verifying grub.cfg when loading it (f:108264)
  - commands/legacycfg: Avoid closing file twice (f:108264)
  - commands/efi/tpm: Re-enable measurements on confidential computing platforms (f:108264)
  - acpi: Fix out of bounds access in grub_acpi_xsdt_find_table() (f:108264)
  - use confidential computing provisioned secrets for disk decryption (f:108264)
  - 10_linux: fix missing "ro" in kernel boot parameters (f:108264)
  - add support for hygon tpcm (f:108264)
  - Inherit 'Add BLS Support' patch from grub-2.06 (f:108264)
  - remove BuildRequires:pesign >= 0.99-8 and fix bug about petitboot doesn't ignore EFI entries for ppc64le (f:108264)
  - Export all variables from the initial context when creating a submenu (f:108264)
  - add support for ppc64le (f:108264)
  - fix log printing in tpcm_kunpeng module again (f:108264)
  - fix log printing in tpcm_kunpeng module (f:108264)
  - Add gfxterm_background and serial modules to grub.efi (f:108264)
  - disk/mdraid1x_linux: Prevent infinite recursion (f:108264)
  - lib/libtasn1: Fix ETYPE_OK off by one array size check (v:108264)[CVE-2021-46848]


author: lizhengde <lizhengde@xfusion.com> - 1.16.2-14
changelog:
  - Type:CVE
  - CVE:CVE-2026-53702
  - SUG:NA
  - DESC:Stack buffer overflow in GStreamer H.265 parser. Fix incorrect loop bound.


author: Funda Wang <fundawang@yeah.net> - 1.22.5-2
changelog:
  - fix CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600,
    CVE-2024-47607, CVE-2024-47615, CVE-2024-47835


author: xinghe <xinghe2@h-partners.com> - 2.9.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:stream: Prevent mux upgrades if client connection is no longer ready


author: yanglu <yanglu72@h-partners.com> - 2.9.5-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:queues:Do not use pendconn_grab_from_px
         queues:Make sure we call process_srv_queue when leaving
         queue:Make process_srv_queue return the number of streams


author: xinghe <xinghe2@h-partners.com> - 2.9.5-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:haproxy: only tid 0 must not sleep if got signal
         server/addr: fix tune.events.max-events-at-once event miss and leak


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: Funda Wang <fundawang@yeah.net> - 1.14.5-2
changelog:
  - add patches from azure linux for fixing CVE-2025-2153, CVE-2025-2310,
    CVE-2025-2914, CVE-2025-2926, CVE-2025-6816, CVE-2025-2925,
    CVE-2025-2924, CVE-2025-44905, CVE-2025-6269, CVE-2025-6750,
    CVE-2025-6857, CVE-2025-7067, CVE-2025-7068, CVE-2025-6858,
    CVE-2025-2923, CVE-2025-2913, CVE-2025-6516, CVE-2025-6818,
    CVE-2025-6817, CVE-2025-6856, CVE-2025-7069


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 2.4.58-12.kb2
changelog:
  - sync httpd 2.4.58-15 from openEuler 24.03 LTS (f:156505)
  - fix CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032 (v:156505)[CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032]
  - fix CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059 (v:156505)[CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059]
  - fix CVE-2026-28780 (v:156505)[CVE-2026-28780]


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1.10.2-3.kb1
changelog:
  - sync libgcrypt 1.10.2-3.oe2403 from openEuler 24.03 LTS (f:156521)
  - fix CVE-2026-41989 (v:156521)[CVE-2026-41989]


author: wangkai <13474090681@163.com> - 2.5.31-3
changelog:
  - Fix CVE-2026-40334, CVE-2026-40334, CVE-2026-40338, CVE-2026-40339,
    CVE-2026-40340, CVE-2026-40341


author: xinghe <xinghe2@h-partners.com> - 2:1.6.40-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: yangfeng <yangfeng@kylinsec.com.cn> - 2:1.6.40-12.kb1
changelog:
  - sync libpng 1.6.40-12 from openEuler 24.03 LTS (f:156477)
  - fix CVE-2026-40930 patch error (v:156477)[CVE-2026-40930]
  - fix CVE-2026-40930 (v:156477)[CVE-2026-40930]
  - fix CVE-2026-3713 (v:156477)[CVE-2026-3713]
  - fix CVE-2026-34757 (v:156477)[CVE-2026-34757]
  - fix CVE-2026-33416 CVE-2026-33636 (v:156477)[CVE-2026-33416,CVE-2026-33636]


author: nickyang <nickyang228@163.com> - 2.74.3-12
changelog:
  - Type:cves
  - ID:CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716
  - SUG:NA
  - DESC:fix CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716


author: nickyang <nickyang228@163.com> - 2.74.3-13
changelog:
  - Type:cves
  - ID:CVE-2026-1760 CVE-2026-1801 CVE-2026-2369
  - SUG:NA
  - DESC:fix CVE-2026-1760 CVE-2026-1801 CVE-2026-2369


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1.2.4-4.kb2
changelog:
  - sync musl 1.2.4-6 from openEuler 24.03 LTS (f:141877)
  - fix CVE-2026-40200, CVE-2026-6042 (v:141877)[CVE-2026-40200,CVE-2026-6042]
  - Fix ld file not found (f:141877)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: puhongyu <puhongyu@kylinsec.com.cn> - 8.0.46-1.kb1
changelog:
  - Update to 8.0.46 for fix CVEs (CVE-2026-21998, CVE-2026-22001, CVE-2026-22002,CVE-2026-22004, CVE-2026-22005, CVE-2026-22009, CVE-2026-22015, CVE-2026-22017,CVE-2026-34267, CVE-2026-34270, CVE-2026-34271, CVE-2026-34276, CVE-2026-34278,CVE-2026-34293, CVE-2026-34303, CVE-2026-34304, CVE-2026-34308, CVE-2026-35236,CVE-2026-35237, CVE-2026-35238, CVE-2026-35239, CVE-2026-35240) (v:156544)[CVE-2026-21998, CVE-2026-22001, CVE-2026-22002,CVE-2026-22004, CVE-2026-22005, CVE-2026-22009, CVE-2026-22015, CVE-2026-22017,CVE-2026-34267, CVE-2026-34270, CVE-2026-34271, CVE-2026-34276, CVE-2026-34278,CVE-2026-34293, CVE-2026-34303, CVE-2026-34304, CVE-2026-34308, CVE-2026-35236,CVE-2026-35237, CVE-2026-35238, CVE-2026-35239, CVE-2026-35240]
  - fix install mariadb-config error on mysql-config installed (f:156544)
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968) (v:156544)[CVE-2026-21936,CVE-2026-21937,CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968]
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040) (v:156544)[CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040]
  - fix sw_64 build error (f:156544)


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.24.0-6.kb4
changelog:
  - sync nginx 1.24.0-10 from openEuler 24.03 LTS (f:156480)
  - fix CVE-2026-42946 CVE-2026-40701 CVE-2026-42934 (v:156480)[CVE-2026-42946,CVE-2026-40701,CVE-2026-42934]
  - fix CVE-2026-42945 (v:156480)[CVE-2026-42945]
  - fix CVE-2026-27654 CVE-2026-27784 CVE-2026-32647 (v:156480)[CVE-2026-27654,CVE-2026-27784,CVE-2026-32647]
  - fix CVE-2026-1642 (v:156480)[CVE-2026-1642]


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.24.0-6.kb5
changelog:
  - sync nginx 1.24.0-12 from openEuler 24.03 LTS SP3 (f:161491)
  - fix CVE-2026-49975 (v:161491)[CVE-2026-49975]
  - Fix CVE-2026-9256 (v:161491)[CVE-2026-9256]


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.24.0-6.kb6
changelog:
  - sync nginx 1.24.0-13 from openEuler 24.03 LTS SP3 (f:163905)
  - fix CVE-2026-48142 CVE-2026-42055 (v:163905)[CVE-2026-48142,CVE-2026-42055]


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 2:7.94-7.kb3
changelog:
  - sync nmap 7.94-10 from openEuler 24.03 LTS SP3 (f:165410)
  - delete taboo words (f:165410)
  - backport Fix off-by-one overflow in the IP protocol table (f:165410)


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: puhongyu <puhongyu@kylinsec.com.cn> - 1:20.18.2-3.kb5
changelog:
  - sync nodejs 20.18.2- from openEuler 24.03 LTS (f:141908)
  - Followup fix CVE-2026-21637 and fix CVE-2026-21710, CVE-2026-21713,CVE-2026-21714, CVE-2026-21715, CVE-2026-21716, CVE-2026-21717 (v:141908)[CVE-2026-21637, CVE-2026-21710, CVE-2026-21713,CVE-2026-21714, CVE-2026-21715, CVE-2026-21716, CVE-2026-21717]
  - Fix random crashes on riscv64 architecture (f:141908)
  - Fix CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,CVE-2025-59465, CVE-2025-59466, CVE-2026-21637 (v:141908)[CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,CVE-2025-59465, CVE-2025-59466, CVE-2026-21637]
  - add sw64 support of node-v20.18.2 in openEuler-24.03-LTS-SP2 (f:141908)


author: xu_ping <707078654@qq.com> - 3.24.0-1
changelog:
  - Upgrade version to 3.24.0
    * Add support for FIPS-session mode
    * Updates to harden against RSA timing attacks
    * Add option to show the master key verification patterns of secure keys
    * Add support for exporting a key or certificate as URI-PEM file
    * Performance improvements for attribute retrieval
    * Add support for SHA-2 mechanisms
    * Experimental support for IBM Dilithium via OpenSSL OQS provider
    * Support live guest relocation for protected key (PKEY) operations
    * Add support for CKA_ALWAYS_AUTHENTICATE
    * Add support for CKD_*_SP800 KDFs for ECDH
    * Add support for SHA based key derivation mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms
    * Add support for building Opencryptoki on the IBM AIX platform
    * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
    * Add support for protecting tokens with a token specific user group
    * Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
    * Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later


author: zhang_wenyu <zhang_wenyu@hoperun.com> - 3.25.0-1
changelog:
  - Upgrade version to 3.25.0
    * Add support for PKCS#11 v3.0 SHAKE key derivation
    * Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
    * Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
    * Add support for CCA AES CIPHER secure key types
    * Add support for the CKM_ECDH1_DERIVE mechanism
    * Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
    * Add support for the CKM_RSA_AES_KEY_WRAP mechanism
    * Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
    * Add a tool for import and exporting PKCS#11 keys to a KMIP server
    * Add support for opaque secure key blob import via C_CreateObject
    * Add support for key wrapping with AES-GCM
    * Add support for newer CCA versions on s390x and non-s390x platforms
    * Add support for CKM_AES_GCM (single-part operations only)


author: Funda Wang <fundawang@yeah.net> - 0.23.0-7
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: yixiangzhike <yixiangzhike007@163.com> - 1:3.0.12-52
changelog:
  - Type:CVE
  - CVE:CVE-2026-34180 CVE-2026-34182 CVE-2026-42766 CVE-2026-42767 CVE-2026-42770 CVE-2026-45447 CVE-2026-7383 CVE-2026-907
  - SUG:NA
  - DESC:fix CVE-2026-34180 CVE-2026-34182 CVE-2026-42766 CVE-2026-42767 CVE-2026-42770 CVE-2026-45447 CVE-2026-7383 CVE-2026-9076


author: wangkai <13474090681@163.com> - 2.6.9-8
changelog:
  - Fix CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
    CVE-2026-13117, CVE-2026-13122, CVE-2026-13698


author: Funda Wang <fundawang@yeah.net> - 4:5.38.0-11
changelog:
  - split out patch adding link to libperl.so into two separated patches,
    and sync it with mageia, which is a better version than fedora
  - disable cleaning empty perl directories
  - use git lfs storage


author: shenzhongwei <shenzhongwei@kylinos.cn> - 1.3.8b-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix: %patchN is deprecated (7 usages found), use %patch N (or %patch -P N)


author: puhongyu <puhongyu@kylinsec.com.cn> - 1.3.9a-2.kb1
changelog:
  - sync proftpd 1.3.9a-2 from openEuler 24.03 LTS (f:156545)
  - Fix CVE-2026-44331 (v:156545)[CVE-2026-44331]
  - Update to 1.3.9a for fix CVE-2026-42167 (v:156545)[CVE-2026-42167]
  - Add 'proxy' sub-package with unbundled mod_proxy (f:156545)
  - Use libsodium to provide ed25519 key support for mod_sftp (f:156545)
  - Update logrotate snippet to use try-reload-or-restart rather than reload for distributions with systemd 229 or later (f:156545)
  - backport some patches from upstream (f:156545)


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.17.1-16
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: gaihuiying <eaglegai@163.com> - 1.17.1-17
changelog:
  - Type:cves
  - CVE:CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608
  - SUG:NA
  - DESC:fix CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608


author: Junqi Ma <majunqi1@huawei.com> - 11:8.2.0-48
changelog:
  - target/s390x: Fix MVC not always invalidating translation blocks
  - target/sparc: Fix gdbstub incorrectly handling registers f32-f62
  - virtio-net: Fix size check in dhclient workaround
  - vdpa: Fix endian bugs in shadow virtqueue
  - x86/loader: only patch linux kernels
  - target/ppc: Fix e200 duplicate SPRs
  - vfio/container: For CSV3 VM, only register listener to shared_memory_listener list in vfio_connect_container()
  - target/riscv/kvm: update the KVM regs to Linux rvck-6.6
  - target/riscv/kvm: Fix exposure of Zkr
  - hw/arm/virt: Introduce a IPIV machine option
  - hw/vfio/migration: Fix vfio migration isn't aborted in a corner case


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-49
changelog:
  - common-user/host/riscv: use tail pseudoinstruction for calling tail
  - meson: Remove CONFIG_STATX and CONFIG_STATX_MNT_ID
  - qga: fix potentially not initialized nr_volumes in qga_vss_fsfreeze()
  - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint(CVE-2024-8354)
  - hw/usb/hcd-xhci: Unmap canceled packet
  - meson: Use has_header_symbol() to check getcpu()
  - hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3
  - migration: fix SEEK_CUR offset calculation in qio_channel_block_seek


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-50
changelog:
  - Revert "hw/arm/virt: Introduce a IPIV machine option"
  - target/arm: add ipiv=on/off option
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64smfr0 into the idregs array
  - arm/cpu: Store id_isar0-7 into the idregs array
  - arm/cpu: Store id_pfr0/1/2 into the idregs array
  - arm/cpu: Store id_dfr0/1 into the idregs array
  - arm/cpu: Store id_mmfr0-5 into the idregs array
  - arm/cpu: Add generated sysreg properties
  - arm/cpu: Add sysreg properties generation
  - arm/cpu: Add infra to handle generated ID register definitions
  - kvm: kvm_get_writable_id_regs
  - arm/kvm: use fd instead of fdarray[2]
  - arm/cpu: switch to a generated cpu-sysregs.h.inc
  - arm/cpu: Add sysreg generation scripts
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: more customization for the kvm host cpu model
  - arm/kvm: write back modified ID regs to KVM
  - arm/kvm: Allow reading all the writable ID registers
  - arm/cpu-features: document ID reg properties
  - arm/qmp-cmds: introspection for ID register props
  - arm/cpu: manually make MIDR/REVIDR/AIDR writable
  - arm/cpu: enable MIDR writable
  - target/arm/kvm: Add SMMC hypercall definitions
  - hw/arm/virt: Initial support to set target_impl CPUs
  - target/arm/kvm: Use PSCI_VERSION for version info
  - target/arm/kvm: Set DISCOVER_IMPL_* hypercalls
  - Fix the compilation of target arm-softmmu


author: huangyan <huangyan@cdjrlc.com> - 11:8.2.0-51
changelog:
  - Add qemu-user package for arm, aarch64, riscv32, riscv64 targets
  - Add user-static, user-binfmt package for statically-linked QEMU user emulator


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-52
changelog:
  - trace: Add trace to measure hot migrate downtime
  - backends: Add support of one guest numa node alloc memory from multi host nodes


author: panchenbo <panchenbo@kylinsec.com.cn> - 11:8.2.0-53.kb2
changelog:
  - sync 8.2.0-53 form openEuler 24.03 LTS SP2(f:114081)
  - enable snapshot for UEFI based virtual machine (b:57253)
  - enable spice vnc and smartcard,Remove some deletion operations.(f:52796)
  - fix loongarch64 virtio-vga unused and fix spec error (b:6789)


author: Wang Zhijiang <wangzhijiang@kylinsec.com.cn> - 11:8.2.0-53.kb4
changelog:
  - sync qemu 8.2.0-55 from openEuler 24.03 LTS (f:141892)
  - target/arm: add kunpeng 920 V1 support (f:141892)
  - target/arm: add kunpeng 950 V1 support (f:141892)
  - target/arm: add kunpeng 920 V2 support (f:141892)
  - hw/virtio/virtio-crypto: verify asym request size(CVE-2025-14876) (v:141892)[CVE-2025-14876]
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876) (v:141892)[CVE-2025-14876]
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243) (v:141892)[CVE-2026-2243]
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519) (v:141892)[CVE-2024-6519]
  - MAINTAINERS: add me as maintainer to virtio-snd (f:141892)
  - virtio-snd: remove TODO comments (f:141892)
  - virtio-snd: handle 5.14.6.2 for PCM_INFO properly(CVE-2026-3196) (v:141892)[CVE-2026-3196]
  - virtio-snd: fix max_size bounds check in input cb(CVE-2026-3195) (v:141892)[CVE-2026-3195]
  - virtio-snd: tighten read amount in in_cb(CVE-2026-3195) (v:141892)[CVE-2026-3195]
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464) (v:141892)[CVE-2025-12464]
  - io: release active GSource in TLS channel finalizer (f:141892)
  - io: move websock resource release to close method (f:141892)
  - io: fix use after free in websocket handshake code(CVE-2025-11234) (v:141892)[CVE-2025-11234]
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665) (v:141892)[CVE-2026-0665]


author: lifeifei <lifeifei@kylinos.cn> - 2.19-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add the socket option IPV6_MULTICAST_LOOP to prevent the interface from autoconfiguring using RA messages sent by itself.


author: puhongyu <puhongyu@kylinsec.com.cn> - 6.2.7-3.kb2
changelog:
  - sync redis6 6.2.7-6 from openEuler 24.03 LTS SP2 (f:158729)
  - Fix CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 (v:158729)[CVE-2025-46817,CVE-2025-46818,CVE-2025-46819]
  - Fix CVE-2025-21605 CVE-2025-32023 CVE-2025-48367 CVE-2025-49844 (v:158729)[CVE-2025-21605,CVE-2025-32023,CVE-2025-48367,CVE-2025-49844]
  - License compliance rectification (f:158729)


author: yefeng <yefeng@kylinsec.com.cn> - 2024.4-2.kb2
changelog:
  - sync rpm-ostree 2024.4-7 from openEuler 24.03 LTS SP3 (b:165415)
  - Revert CVE-2024-12224 fix due to incomplete patch[CVE-2024-12224] (b:165415)
  - Fix CVE-2025-58160[CVE-2025-58160] (b:165415)
  - delete  useless patch (b:165415)
  - Fix CVE-2025-24898[CVE-2025-24898] (b:165415)
  - Fix CVE-2024-12224[CVE-2024-12224] (b:165415)
  - Fix CVE-2025-3416[CVE-2025-3416] (b:165415)


author: Funda Wang <fundawang@yeah.net> - 3.2.7-6
changelog:
  - fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
    CVE-2024-12088, CVE-2024-12747


author: yueyuankun <yueyuankun@kylinos.cn> - 15.7-21
changelog:
  - spec: Remove debugsource requirement from debuginfo
  - Allow debuginfo to be installed alone without pulling in the debugsource package.


author: wjiang <app@cameyan.com> -15.7-22
changelog:
  - Backport bugfix patches from upstream
  - Fix build with binutils 2.46 (c4665d2)
  - Fix memory leak on TPM log error in mirror_one_mok_variable (92630f2)


author: xinghe <xingheyd@163.com> - 7:6.6-8
changelog:
  - Type:cves
  - ID:CVE-2026-33526 CVE-2026-33515 CVE-2026-32748
  - SUG:NA
  - DESC:fix CVE-2026-33526 CVE-2026-33515 CVE-2026-32748


author: panchenbo <panchenbo@kylinsec.com.cn> - 1.9.15p5-5.kb3
changelog:
  - sync sudo 1.9.15p5-6 from openEuler 24.03 LTS (f:141890)
  - Apply patch: backport-CVE-2026-35535.patch (v:141890)[CVE-2026-35535]


author: panchenbo <panchenbo@kylinsec.com.cn> - 255-49.kb1
changelog:
  - fix build failure from duplicate AUDIT_* macros in kernel headers. (b:99100)
  - changed the waiting time for shutdown error to 10 seconds (b:41995)
  - network wont turn on when it starts up causing slow start (b:39560)
  - expand udev line size for property buffer overflow (b:22555)
  - Remove pretty symbols to ensure compatibility with legacy systems. (b:82004)
  - Revert "user: delegate cpu controller, assign weights to user slices" (b:92078)
  - Fix multi-user switching black screen or stuck problem (b:91710)


author: gaobo <gaobo@kylinsec.com.cn> - 255-49.kb5
changelog:
  - sync systemd 255-57 from openEuler 24.03 LTS (f:141912)
  - network networkd address does not set up firewall rules (f:141912)


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 255-49.kb6
changelog:
  - sync systemd 255-59 from openEuler 24.03 LTS SP3 (f:161667)
  - fix CVE-2026-40225 (v:161667)[CVE-2026-40225]
  - fix CVE-2026-40226 (v:161667)[CVE-2026-40226]
  - fix CVE-2026-29111 (v:161667)[CVE-2026-29111]
  - fix CVE-2026-4105 (v:161667)[CVE-2026-4105]
  - fix coredump generation when systemd-resolved and systemd-networkd service is started then uninstalled (f:161667)
  - sync community patches (f:161667)
  - backport community patches and skip bios_version test: (f:161667)
  - umount do not move busy network mounts (f:161667)
  - fix udevadm trigger coredump after execute mount / (f:161667)
  - add backport-network-networkd-address-don-t-set-up-firewall-rules.patch (f:161667)


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: yaoxin <1024769339@qq.com> - 1:9.0.119-1
changelog:
  - Update to 9.0.119 for fix CVEs: CVE-2026-50229, CVE-2026-53404,
    CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956,
    CVE-2026-55957


author: Hongjian Dai <daihongjian@kylinsec.com.cn> - 9.2.11-3.kb1
changelog:
  - sync trafficserver 9.2.11-3 from openEuler 24.03 LTS (f:156507)
  - Fix CVE-2025-58136 and CVE-2025-65114 (v:156507)[CVE-2025-58136,CVE-2025-65114]
  - update config.guess and config.sub to fix build error (f:156507)
  - Update to 9.2.11 for fix CVE-2025-49763 and CVE-2025-31698 (v:156507)[CVE-2025-49763,CVE-2025-31698]
  - Update to 9.2.9 (f:156507)


