Skip to content

CTRL-OS Security Tracker

CTRL-OS Security Tracker

CTRL-OS Security Tracker

CTRL-OS Security Tracker CTRL-OS Security Tracker
Table of contents
- Releases
- Latest Events
Linux Kernel Policy

CTRL-OS Security Tracker

This is the security tracker for CTRL-OS. It allows monitoring the status of vulnerabilities that affect CTRL-OS releases. Vulnerabilities are ingested from official sources, such as NVD and others.

For general information about installing or upgrading CTRL-OS, refer to the documentation. We are eager to hear your feedback and suggestions for this security tracker. Channels to reach us are documented here.

Releases

These are the currently supported releases.

CTRL-OS 26.05

Latest Events

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

2026-08-01 01:07 CEST

New → Resolved

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

2026-08-01 01:07 CEST

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

2026-08-01 01:06 CEST

New → Plausible

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

2026-08-01 01:04 CEST

strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table().

2026-08-01 01:02 CEST

New → Resolved

strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table().

2026-08-01 01:02 CEST

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

2026-08-01 01:01 CEST

New → Resolved

fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution

2026-08-01 01:01 CEST

New → Resolved

fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution

2026-08-01 01:00 CEST

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

2026-08-01 01:00 CEST

New → Resolved

Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins

2026-08-01 00:59 CEST

New → Resolved

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

2026-08-01 00:58 CEST

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable

2026-08-01 00:56 CEST

New → Resolved

ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp

2026-08-01 00:56 CEST

New → Resolved

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material,

2026-08-01 00:53 CEST

New → Resolved

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input

2026-08-01 00:53 CEST

New → Resolved

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

2026-08-01 00:52 CEST

New → Resolved

zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()

2026-08-01 00:52 CEST

New → Resolved

ffmpeg_4, ffmpeg_6, ffmpeg_7, ffmpeg_8

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.

2026-08-01 00:49 CEST

New → Unaffected

Code not present. The issue was only briefly found in the development branch that led to `8.0`.

Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)

2026-08-01 00:22 CEST

Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)

2026-08-01 00:22 CEST

Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)

2026-08-01 00:22 CEST

Plausible → Resolved

Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)

2026-08-01 00:22 CEST

New → Plausible

ffmpeg_4, ffmpeg_6, ffmpeg_7, ffmpeg_8

Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)

2026-08-01 00:22 CEST

Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend

2026-08-01 00:22 CEST

Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend

2026-08-01 00:22 CEST

Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend

2026-08-01 00:22 CEST

Unaffected → Resolved

Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend

2026-08-01 00:22 CEST

New → Unaffected

Code not present.

ffmpeg_4, ffmpeg_6, ffmpeg_7, ffmpeg_8

Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend

2026-08-01 00:22 CEST

ffmpeg_4, ffmpeg_6, ffmpeg_7, ffmpeg_8

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.

2026-08-01 00:22 CEST