2,978 results · Clear filters · Feed
-
High max 8.7ALSA-2025:14126 1 CVE
Important: pki-deps:10.6 security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System. Security Fix(es): * com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999) For more details about the…
first Aug 20, 2025 -
High max 8.6ALSA-2025:1372 1 CVE
Important: container-tools:rhel8 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (CVE-2024-…
first Feb 13, 2025 -
High max 7.8ALSA-2024:8353 1 CVE
Important: NetworkManager-libreswan security update
This package contains software for integrating the libreswan VPN software with NetworkManager and the GNOME desktop Security Fix(es): * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050) For more details about the security iss…
first Oct 23, 2024 -
High max 9.8ALSA-2025:14743 5 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer …
first Aug 27, 2025 -
High max 9.8ALSA-2024:8834 1 CVE
Important: python-gevent security update
gevent is a coroutine-based Python networking library that uses greenlet to provide a high-level synchronous API on top of libevent event loop. Features include: * convenient API around greenlets * familiar synchronization primitives (gevent.event, gevent.que…
first Nov 5, 2024 -
High max 10.0ALSA-2024:8327 2 CVEs
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875) For…
first Oct 22, 2024 -
High max 10.0ALSA-2024:6422 1 CVE
Important: bubblewrap and flatpak security update
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-…
first Sep 5, 2024 -
High max 8.8ALSA-2024:5531 1 CVE
Important: python3.12-setuptools security update
Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptool…
first Aug 19, 2024 -
High max 7.5ALSA-2024:5524 2 CVEs
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Aug 19, 2024 -
High max 9.8ALSA-2024:5391 11 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * Firefox: 115.14/128.1 ESR () * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518) * mo…
first Aug 14, 2024 -
High max 9.1
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Encoding problem in mod_proxy (CVE-2024-38473) * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) * httpd: Improp…
first Jul 23, 2024 -
High max 8.3ALSA-2024:1902 6 CVEs
Important: shim security update
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments. Security Fix(es): * shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547) * shim: Interger ov…
first Apr 18, 2024 -
High max 7.5ALSA-2024:1786 1 CVE
Important: httpd:2.4/mod_http2 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_http2: CONTINUATION frames DoS (CVE-2024-27316) For more details about the security issue(s), including the impact, a CVSS scor…
first Apr 11, 2024 -
High max 7.5ALSA-2024:1782 3 CVEs
Important: bind and dhcp security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Apr 12, 2024 -
High max 7.5ALSA-2024:1781 6 CVEs
Important: bind9.16 security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Apr 11, 2024 -
High max 8.0ALSA-2024:1751 1 CVE
Important: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runti…
first Apr 11, 2024 -
High max 7.5ALSA-2024:1690 1 CVE
Important: varnish security update
Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/2 Broken Window Attack …
first Apr 8, 2024 -
High max 7.9ALSA-2024:1687 7 CVEs
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (…
first Apr 8, 2024 -
High max 7.5ALSA-2024:1646 1 CVE
Important: grafana security and bug fix update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) Bug Fix(es): * TRIAGE CVE-2024-1…
first Apr 2, 2024 -
High max 7.5ALSA-2024:1644 1 CVE
Important: grafana-pcp security and bug fix update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang-fips/openssl: Memory leaks in…
first Apr 2, 2024 -
High max 8.8ALSA-2024:10830 3 CVEs
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 5, 2024 -
High max 8.8ALSA-2024:10785 3 CVEs
Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
High max 8.8ALSA-2024:10752 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandle…
first Dec 3, 2024 -
High max 8.3ALSA-2024:1063 2 CVEs
Important: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023…
first Mar 4, 2024 -
High max 8.8ALSA-2024:10591 7 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159) * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CV…
first Dec 2, 2024 -
High max 7.4ALSA-2024:10379 2 CVEs
Important: pam security update
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041) * pam: Impro…
first Nov 26, 2024 -
High max 8.0ALSA-2024:0974 1 CVE
Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including th…
first Feb 26, 2024 -
High max 8.0ALSA-2024:0973 1 CVE
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including th…
first Feb 26, 2024 -
High max 7.5ALSA-2024:0965 2 CVEs
Important: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU reso…
first Feb 26, 2024 -
High max 8.1ALSA-2024:0964 8 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.8.0. Security Fix(es): * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546) * Mozilla: Alert dialog could have been spoofed o…
first Feb 26, 2024 -
High max 8.0ALSA-2024:0956 1 CVE
Important: postgresql:10 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including th…
first Feb 26, 2024 -
High max 8.1ALSA-2024:0955 8 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.8.0 ESR. Security Fix(es): * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546) …
first Feb 26, 2024 -
High max 7.8ALSA-2024:0897 19 CVEs
Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623) * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921) * kernel: inactive elements in nft_…
first Feb 20, 2024 -
High max 8.1ALSA-2024:0893 1 CVE
Important: python-pillow security update
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es): * pillow: Arbitrary Code Execution via the en…
first Feb 20, 2024 -
High max 7.8ALSA-2024:0861 2 CVEs
Important: gimp:2.8 security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-lev…
first Feb 19, 2024 -
High max 7.5ALSA-2024:0827 2 CVEs
Important: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Feb 15, 2024 -
High max 7.5ALSA-2024:0808 2 CVEs
Important: dotnet6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Feb 13, 2024 -
High max 7.5ALSA-2024:0806 2 CVEs
Important: dotnet7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Feb 13, 2024 -
High max 8.6ALSA-2024:0752 1 CVE
Important: container-tools:rhel8 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: file descriptor leak (CVE-2024-21626) For more details about the security issue(s), including the impact, a CVSS score,…
first Feb 8, 2024 -
High max 8.8ALSA-2024:0609 9 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.7.0. Security Fix(es): * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741) * Mozilla: Failure to update user input timestamp (CVE-2024-0742) * M…
first Jan 30, 2024