koji: recent builds

complete: libXrender-0.9.11-5.ocs23, target: dist-ocs23-base

Tue, 29 Sep 2026 11:54:15 CST

* Wed Sep 23 2026 PkgAgent Robot  - 0.9.11-5
- [Type] security
- [DESC] Fix CVE-2026-88807: OOB write in XRenderQueryFormats when server reports numSubpixel > numScreens

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 0.9.11-4
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 0.9.11-3
- Rebuilt for loongarch release

complete: bind-dyndb-ldap-11.10-13.ocs23, target: dist-ocs23-base

Tue, 29 Sep 2026 11:05:37 CST

* Tue Sep 29 2026 bbrucezhang  - 11.10-13
- [Type] sync
- [DESC] Rebuilt for bind

* Thu Sep 24 2026 Rebuild Robot  - 11.10-12
- [Type] sync
- [DESC] Rebuilt for bind

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 11.10-11
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

complete: qemu-8.2.2-54.ocs23, target: dist-ocs23-base

Mon, 28 Sep 2026 18:04:54 CST

* Fri Sep 25 2026 PkgAgent Robot  - 8.2.2-54
- [Type] security
- [DESC] Fix CVE-2026-93834: 9pfs use-after-free in v9fs_co_open2() fid path mutation from worker thread

* Thu Sep 17 2026 PkgAgent Robot  - 8.2.2-53
- [Type] security
- [DESC] Fix CVE-2026-12080: qemu-guest-agent symlink following vulnerability in guest-ssh-* commands

* Wed Sep 09 2026 Hui Li  - 8.2.2-52
- [Type] bugfix
- [DESC] target/loongarch: clear the registers when cpu is reset

complete: crash-8.0.4-7.ocs23, target: dist-ocs23-base

Mon, 28 Sep 2026 17:39:56 CST

* Wed Sep 23 2026 PkgAgent Robot  - 8.0.4-7
- [Type] security
- [DESC] Fix CVE-2026-13732: out-of-bounds write in bundled gdb stabs parser (read_member_functions)

* Wed May 21 2025 Ming Wang  - 8.0.4-6
- Set the NR_CPUS macro in the crash tool to 2048 to match the kernel's value

* Mon Mar 10 2025 huwentao  - 8.0.4-5
- fix a potential segfault when unwind frame

complete: gdb-13.2-11.ocs23, target: dist-ocs23-base

Mon, 28 Sep 2026 17:20:44 CST

* Wed Sep 23 2026 PkgAgent Robot  - 13.2-11
- [Type] security
- [DESC] Fix CVE-2026-13732: out-of-bounds write in STABS read_member_functions()

* Mon Dec 01 2025 Chunsheng Luo  - 13.2-10
- Don't allow a howto witha NULL name [CVE-2025-11840]

* Tue Oct 21 2025 Chunsheng Luo  - 13.2-9
- elf: Return error on unsorted symbol table if not allowed [CVE-2025-11414]
- PR 33452 SEGV in bfd_elf_gc_record_vtentry [CVE-2025-11412]
- elf: Disallow the empty global symbol name [CVE-2025-11413]
- x86: Keep _GLOBAL_OFFSET_TABLE_ for .eh_frame [CVE-2025-11494]

complete: linux-firmware-20250917-6.ocs23, target: dist-ocs23-base

Mon, 28 Sep 2026 14:31:16 CST

* Mon Sep 28 2026 PkgAgent Robot  - 20250917-6
- [Type] security
- [DESC] Fix CVE-2026-49744: update Imagination PowerVR Rogue GPU firmware to 1.1.OS

* Wed Aug 26 2026 liujie_answer  - 20250917-5
- [Type] bugfix
- [DESC] Move sxe2.cfg from linkdata-sxe2-firmware subpackage into the main package
- This configuration file is from Linkdata, supporting Linkdata Ethernet Controller advanced feature configuration.

* Wed Jul 22 2026 liujie_answer  - 20250917-4
- [Type] bugfix
- [DESC] Add linkdata linux-firmware sub-package required
- This configuration file is from Linkdata, supporting Linkdata Ethernet Controller advanced feature configuration.

complete: gd-2.3.3-10.ocs23, target: dist-ocs23-base

Thu, 24 Sep 2026 16:40:43 CST

* Fri Sep 18 2026 PkgAgent Robot  - 2.3.3-10
- [Type] security
- [DESC] Fix CVE-2026-9672: GIF decoder buffer overflow (uninitialized LZW table / improper end-of-image handling)

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 2.3.3-9
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 2.3.3-8
- Rebuilt for loongarch release

complete: pcs-0.11.5-24.ocs23, target: dist-ocs23-base

Thu, 24 Sep 2026 16:35:03 CST

* Wed Sep 16 2026 PkgAgent Robot  - 0.11.5-24
- [Type] security
- [DESC] Fix CVE-2026-91990 (bundled tornado 6.2.0 -> 6.5.8, multipart form-data memory amplification)

* Sun Aug 02 2026 PkgAgent Robot  - 0.11.5-23
- [Type] security
- [DESC] Update bundled puma to 7.2.1 (fixes CVE-2026-47736, CVE-2026-47737 PROXY protocol v1)

* Sun May 10 2026 PkgAgent Robot  - 0.11.5-22
- [Type] security
- [DESC] upgrade rubygem-rack to 3.1.21. fix CVE-2026-22860, CVE-2026-25500, CVE-2026-26961, CVE-2026-34230, CVE-2026-34763, CVE-2026-34786, CVE-2026-34826, CVE-2026-34827, CVE-2026-34829, CVE-2026-34830.

complete: bind-dyndb-ldap-11.10-12.ocs23, target: dist-ocs23-base

Thu, 24 Sep 2026 15:31:26 CST

* Thu Sep 24 2026 Rebuild Robot  - 11.10-12
- [Type] sync
- [DESC] Rebuilt for bind

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 11.10-11
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Mon Sep 02 2024 Xin Cheng  - 11.10-10
- [Type] bugfix
- [DESC] fix error "isc/stdatomic.h does not support your compiler"

complete: gnome-connections-43.0-8.ocs23, target: dist-ocs23-base

Thu, 24 Sep 2026 14:26:19 CST

* Sun Sep 20 2026 TencentOS Release Engineering  - 43.0-8
- [Type] bugfix
- [DESC] Backport the complete FreeRDP 3 API adaptation for bundled gtk-frdp

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 43.0-7
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 43.0-6
- Rebuilt for loongarch release

complete: bind-9.18.21-8.ocs23, target: dist-ocs23-base

Thu, 24 Sep 2026 11:06:06 CST

* Wed Sep 23 2026 PkgAgent Robot  - 9.18.21-8
- [Type] security
- [DESC] Fix CVE-2026-80274: keep NOQNAME proof selection consistent

* Thu Sep 17 2026 PkgAgent Robot  - 9.18.21-7
- [Type] security
- [DESC] Fix CVE-2026-19667: reject negative cache records that do not fit in a dns_rdata_t (0-byte negative cache entry aborts named)

* Mon Jul 27 2026 PkgAgent Robot  - 9.18.21-6
- [Type] security
- [DESC] Fix CVE-2026-12617, CVE-2026-11721

complete: expat-2.6.4-9.ocs23, target: dist-ocs23-base

Wed, 23 Sep 2026 16:51:26 CST

* Wed Sep 23 2026 PkgAgent Robot  - 2.6.4-9
- [Type] security
- [DESC] Fix CVE-2026-72522: *_toUtf16 mis-classify low surrogates as high surrogates

* Thu Sep 10 2026 PkgAgent Robot  - 2.6.4-8
- [Type] security
- [DESC] Fix CVE-2026-76641: out-of-bounds read from hash table entries created by dtdCopy

* Wed Aug 19 2026 PkgAgent Robot  - 2.6.4-7
- [Type] security
- [DESC] Fix CVE-2026-66046: quadratic runtime in storeAtts() isCdata lookup migrated to hash table lookup

complete: rpcbind-1.2.6-7.ocs23, target: dist-ocs23-base

Wed, 23 Sep 2026 15:49:55 CST

* Wed Sep 23 2026 PkgAgent Robot  - 1.2.6-7
- [Type] security
- [DESC] Fix CVE-2026-94640: bound addrinfo/rmtinfo stats lists to prevent unbounded memory growth (DoS)

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 1.2.6-6
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 1.2.6-5
- Rebuilt for loongarch release

complete: freerdp-3.31.1-1.ocs23, target: dist-ocs23-base

Wed, 23 Sep 2026 15:36:15 CST

* Tue Sep 22 2026 Xinlong Chen  - 3.31.1-1
- [Type] sync
- [DESC] Upgrade to upstream version 3.31.1

* Thu Sep 03 2026 PkgAgent Robot  - 2.11.6-19
- [Type] security
- [DESC] Fix CVE-2026-85089: zero reserved padding bytes in Save Session Info PDU writers (Stream_Seek to Stream_Zero) and zero-initialize wStream buffers

* Tue Aug 25 2026 PkgAgent Robot  - 2.11.6-18
- [Type] security
- [DESC] Fix CVE-2026-55193 (TS Gateway rpc max fragment size checks), CVE-2026-55191 (h264 avc444 buffer bounds checks), CVE-2026-55194 (RPC response reassembly uses StubLength not alloc_hint)

complete: bind-9.18.21-7.ocs23, target: dist-ocs23-base

Wed, 23 Sep 2026 14:56:10 CST

* Thu Sep 17 2026 PkgAgent Robot  - 9.18.21-7
- [Type] security
- [DESC] Fix CVE-2026-19667: reject negative cache records that do not fit in a dns_rdata_t (0-byte negative cache entry aborts named)

* Mon Jul 27 2026 PkgAgent Robot  - 9.18.21-6
- [Type] security
- [DESC] Fix CVE-2026-12617, CVE-2026-11721

* Thu Jun 04 2026 PkgAgent Robot  - 9.18.21-5
- [Type] security
- [DESC] Fix CVE-2026-5946: disable recursion/UPDATE/NOTIFY for non-IN classes, validate DNS CLASS early, reject metaclasses in UPDATE/NOTIFY, skip deny-answer-address for non-IN

complete: unbound-1.17.1-15.ocs23, target: dist-ocs23-base

Wed, 23 Sep 2026 10:22:29 CST

* Thu Sep 17 2026 PkgAgent Robot  - 1.17.1-15
- [Type] security
- [DESC] Fix CVE-2026-81642 (heap buffer overflow when digesting DNSKEY in DNSSEC validator)

* Mon Jul 27 2026 PkgAgent Robot  - 1.17.1-14
- [Type] security
- [DESC] Fix CVE-2026-44690 (cross-zone wildcard cache poisoning via RRSIG.labels manipulation)

* Mon Jun 01 2026 PkgAgent Robot  - 1.17.1-13
- [Type] security
- [DESC] Fix CVE-2026-42959, CVE-2026-42960

complete: libXfont2-2.0.6-9.ocs23, target: dist-ocs23-base

Tue, 22 Sep 2026 17:29:46 CST

* Tue Sep 22 2026 PkgAgent Robot  - 2.0.6-9
- [Type] security
- [DESC] Fix CVE-2026-59679: validate num_chars against encoding array size in fs_read_glyphs to prevent OOB heap access

* Fri Aug 07 2026 PkgAgent Robot  - 2.0.6-8
- [Type] security
- [DESC] Fix CVE-2026-44950: bounds-check cumulative glyph data writes in fs_read_glyphs to prevent heap buffer overflow

* Fri Jul 10 2026 xiaoyunzhao  - 2.0.6-7
- [Type] security
- [Desc] Fix CVE-2026-56001, CVE-2026-56002, CVE-2026-56003

complete: python-productmd-1.41-1.ocs23, target: dist-ocs23-base

Tue, 22 Sep 2026 17:18:16 CST

* Mon Jun 22 2026 PkgAgent Robot  - 1.41-1
- [Type] sync 
- [DESC] update to Version 1.41

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 1.36-3
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 1.36-2
- Rebuilt for loongarch release

complete: wget-1.21.3-10.ocs23, target: dist-ocs23-base

Tue, 22 Sep 2026 16:56:16 CST

* Thu Sep 17 2026 PkgAgent Robot  - 1.21.3-10
- [Type] security
- [DESC] Fix CVE-2026-58469: heap buffer underflow in metalink URL handling

* Wed Nov 20 2024 Weiyao Feng  - 1.21.3-9
- [type] security
- [desc] fix CVE-2024-10524

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 1.21.3-8
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

complete: tomcat-9.0.121-1.ocs23, target: dist-ocs23-base

Tue, 22 Sep 2026 10:45:11 CST

* Thu Sep 17 2026 PkgAgent Robot  - 9.0.121-1
- [Type] security
- [DESC] Update to 9.0.121 (fixes CVE-2026-65905, CVE-2026-65182, CVE-2026-65927, CVE-2026-66422, CVE-2026-73180, CVE-2026-65637, CVE-2026-65183)

* Thu Jul 16 2026 PkgAgent Robot  - 9.0.120-1
- [Type] security
- [DESC] Update to 9.0.120 (fixes CVE-2026-59083)

* Mon May 18 2026 PkgAgent Robot  - 9.0.117-3
- [Type] security
- [DESC] Fix CVE-2026-42498, CVE-2026-43515