2,978 results · Clear filters · Feed
-
High max 9.8ALSA-2024:6683 8 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: 115.15/128.2 () * mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-8381) * mozilla: Internal event interfaces were exp…
first Sep 16, 2024 -
High max 9.8ALSA-2024:6681 8 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: 115.15/128.2 ESR () * mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-83…
first Sep 16, 2024 -
High max 7.5ALSA-2024:6194 3 CVEs
Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang: crypto/x509: Verify panics on certifica…
first Sep 3, 2024 -
High max 7.5ALSA-2024:6946 1 CVE
Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * encoding/gob: golang: Calling Decode…
first Sep 23, 2024 -
High max 7.5ALSA-2024:6913 4 CVEs
Important: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791) * go/parser: golang: Calling any of the Parse functions containing deeply nest…
first Sep 23, 2024 -
High max 10.0ALSA-2024:6356 1 CVE
Important: bubblewrap and flatpak security update
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-…
first Sep 4, 2024 -
High max 8.6ALSA-2024:2055 1 CVE
Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
first Apr 25, 2024 -
High max 7.5ALSA-2026:70391 5 CVEs
Important: containernetworking-plugins security update
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity …
first Sep 22, 2026 -
High max 5.9ALSA-2026:70191 1 CVE
Important: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) Fo…
first Sep 22, 2026 -
High max 8.2ALSA-2026:7002 4 CVEs
Important: nginx security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * …
first Apr 8, 2026 -
High max 7.1ALSA-2026:69608 1 CVE
Important: openexr security update
OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the …
first Sep 21, 2026 -
High max 7.5ALSA-2026:42895 9 CVEs
Important: java-21-openjdk security update
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhanc…
first Jul 22, 2026 -
High max 4.3ALSA-2026:41905 1 CVE
Important: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided …
first Jul 20, 2026 -
High max 7.8ALSA-2026:38878 1 CVE
Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * os: golang: Go os.Root: Symlink following vulne…
first Jul 13, 2026 -
High max 8.8ALSA-2024:1908 7 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.10.0 ESR. Security Fix(es): * GetBoundName in the JIT returned the wrong object (CVE-2024-3852) * Out-o…
first Apr 18, 2024 -
High max 7.5ALSA-2024:1872 1 CVE
Important: mod_http2 security update
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: CONTINUATION frames DoS (CVE-2024-27316) For more details about the security issue(s), including the impact, a CVSS sc…
first Apr 18, 2024 -
High max 7.5ALSA-2024:1503 3 CVEs
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892) * nodejs: re…
first Mar 25, 2024 -
High max 7.5ALSA-2024:2079 1 CVE
Important: git-lfs security update
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang: net/http, x/net/http2: unlimited number of C…
first Apr 29, 2024 -
High max 7.5ALSA-2024:1462 1 CVE
Important: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * golang: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
first Mar 21, 2024 -
High max 7.5ALSA-2024:1334 2 CVEs
Important: dnsmasq security update
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * dnsmasq:…
first Mar 14, 2024 -
High max 7.5ALSA-2024:1134 1 CVE
Important: tomcat security update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589) For more details about the security issue(s), including the im…
first Mar 5, 2024 -
High max 7.5ALSA-2024:11217 1 CVE
Important: skopeo security update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested …
first Dec 17, 2024 -
High max 8.6ALSA-2024:11123 3 CVEs
Important: gstreamer1-plugins-base security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer1-plugins-base: GStreamer has a stack-buf…
first Dec 16, 2024 -
High max 8.8ALSA-2024:10788 3 CVEs
Important: postgresql:16 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
High max 8.3ALSA-2024:1075 2 CVEs
Important: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023…
first Mar 5, 2024 -
High max 7.5ALSA-2024:10590 1 CVE
Important: python-tornado security update
Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools. Security Fix(es): * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804) F…
first Dec 2, 2024 -
High max 8.7ALSA-2024:10978 2 CVEs
Important: python3.12 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Dec 12, 2024 -
High max 6.6ALSA-2024:10860 1 CVE
Important: ruby:3.1 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security is…
first Dec 5, 2024 -
High max 6.6ALSA-2024:10858 1 CVE
Important: ruby security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security is…
first Dec 5, 2024 -
High max 8.8ALSA-2024:10791 3 CVEs
Important: postgresql security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
High max 8.8ALSA-2024:10787 3 CVEs
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
High max 8.8ALSA-2024:10702 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandle…
first Dec 2, 2024 -
High max 8.8ALSA-2024:10592 7 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159) * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CV…
first Dec 2, 2024 -
High max 6.3
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: data isolation bypass vulnerability (CVE-2024-44309) For more details about the security issue(s), including the impact, a CVSS score, acknow…
first Nov 27, 2024 -
High max 7.8ALSA-2024:10384 2 CVEs
Important: tuned security update
The tuned packages provide a service that tunes system settings according to a selected profile. Security Fix(es): * tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root (CVE-2024-52336) * tuned: improper sanitization…
first Nov 26, 2024 -
High max 8.2ALSA-2023:6595 6 CVEs
Important: linux-firmware security, bug fix, and enhancement update
The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fix(es): * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-27635) * hw: intel: Improper access control …
first Nov 7, 2023 -
High max 7.5
Important: go-toolset and golang security and bug fix update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fix(es): * golang: net/http, x/net/http2: rapid stream resets can cause excess…
first Oct 16, 2023 -
High max 7.5ALSA-2023:5689 1 CVE
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Oct 12, 2023 -
HighALSA-2023:5459 1 CVE
Important: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: vulnerable to OS command inject…
first Oct 5, 2023 -
HighALSA-2023:5456 1 CVE
Important: python3.11 security update
Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: …
first Oct 5, 2023