security/zeek: Update to 8.0.10
https://github.com/zeek/zeek/releases/tag/v8.0.10
This release fixes the following vulnerabilities:
- HIGH: SMB: Chains of AndX messages can crash Zeek
- HIGH: DNP3: Memory exhaustion via file control (g70v1) fields
- HIGH: SIP: Memory exhaustion from long request/response paths
- HIGH: DHCP: Memory exhaustion from retained options after analyzer
violation
- HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
entries
- HIGH: SMB: DCE/RPC memory exhaustion from fragment state
[63 lines not shown]
security/vuxml: Mark security/zeek < 8.0.10 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v8.0.10
This release fixes the following vulnerabilities:
- HIGH: SMB: Chains of AndX messages can crash Zeek
- HIGH: DNP3: Memory exhaustion via file control (g70v1) fields
- HIGH: SIP: Memory exhaustion from long request/response paths
- HIGH: DHCP: Memory exhaustion from retained options after analyzer
violation
- HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
entries
- HIGH: SMB: DCE/RPC memory exhaustion from fragment state
[46 lines not shown]
net/rustconn: Update to 0.20.4
- Remove all patches (that were valid for the previous version of cpal
crate)
ChangeLog: https://github.com/totoshko88/RustConn/releases/tag/v0.20.4
Reported by: "github-actions[bot]" <notifications at github.com>
lang/go126: Update to 1.26.7
Changes:
go1.26.7 (released 2026-08-19) includes fixes to the net/http package.
MFH: 2026Q3
(cherry picked from commit 466c3d8ebd2255c98a5461d168e0875f304d9d44)
lang/go125: Update to 1.25.14
Changes:
go1.25.14 (released 2026-08-19) includes fixes to the net/http
package.
MFH: 2026Q3
(cherry picked from commit 578f1cec0b2270176a2da96cf87a0ddde2eb46fc)