2,978 results · Clear filters · Feed
-
HighALSA-2021:2363 1 CVE
Important: gupnp security update
GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible. Security Fix(es): * gupnp: allows DNS rebinding which …
first Jun 9, 2021 -
HighALSA-2021:2290 1 CVE
Important: nginx:1.16 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name …
first Jun 8, 2021 -
HighALSA-2021:2259 1 CVE
Important: nginx:1.18 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name …
first Jun 7, 2021 -
HighALSA-2021:2170 1 CVE
Important: glib2 security and bug fix update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Securi…
first Jun 1, 2021 -
High max 5.6ALSA-2022:7110 7 CVEs
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588) * Information leak in scsi_ioctl() (CVE-2022-0494) *…
first Oct 25, 2022 -
HighALSA-2021:1983 1 CVE
Important: idm:DL1 security update
AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * slapi-nis: NULL dereference (DoS) with specially crafted Bin…
first May 18, 2021 -
HighALSA-2021:1979 1 CVE
Important: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: improper input validation may allow a trusted client to perform HTTP request smuggling (CVE-2020-25097) For more detail…
first May 18, 2021 -
High max 8.8ALSA-2026:80687 4 CVEs
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as r…
first Oct 12, 2026 -
High max 9.8ALSA-2026:8052 5 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information dis…
first Apr 14, 2026 -
High max 8.2ALSA-2026:80510 1 CVE
Important: compat-openssl10 security update
The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is provided for compatibility with previous releases and software that does not support compilation with OpenSSL-1…
first Oct 12, 2026 -
High max 7.5ALSA-2026:79113 3 CVEs
Important: bind9.16 security, bug fix, and enhancement update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Oct 8, 2026 -
High max 8.8ALSA-2022:7190 8 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.4.0. Security Fix(es): * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-…
first Oct 25, 2022 -
High max 9.8ALSA-2022:7089 1 CVE
Important: libksba security update
KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow may lead to remote code execu…
first Oct 24, 2022 -
High max 8.1ALSA-2022:7023 1 CVE
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.3.0. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) For more details about the security issue(…
first Oct 18, 2022 -
High max 8.8ALSA-2022:7070 4 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.4.0 ESR. Security Fix(es): * Mozilla: Same-origin policy violation could have leaked cross-origin URLs …
first Oct 20, 2022 -
High max 8.1ALSA-2022:7024 1 CVE
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-…
first Oct 18, 2022 -
High max 9.1ALSA-2022:6964 2 CVEs
Important: nodejs:16 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16. Security Fix(es): * nodejs: weak randomnes…
first Oct 17, 2022 -
High max 8.1ALSA-2022:6878 1 CVE
Important: expat security update
Expat is a C library for parsing XML documents. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other r…
first Oct 11, 2022 -
High max 7.5ALSA-2021:3918 6 CVEs
Important: redis:5 security update
Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the da…
first Oct 19, 2021 -
HighALSA-2021:4130 6 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.3.0. Security Fix(es): * Mozilla: Use-after-free in HTTP2 Session object * Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3 * Moz…
first Nov 4, 2021 -
HighALSA-2021:4123 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.3.0 ESR. Security Fix(es): * Mozilla: Use-after-free in HTTP2 Session object * Mozilla: Memory safety bu…
first Nov 3, 2021 -
HighALSA-2021:4056 3 CVEs
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385) * kernel: out-of-bounds write due to a heap buffer overflow …
first Nov 2, 2021 -
High max 6.8ALSA-2021:3891 10 CVEs
Important: java-11-openjdk security update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565) * OpenJDK: Inco…
first Oct 20, 2021 -
High max 5.7ALSA-2021:3819 1 CVE
Important: .NET 5.0 security and bugfix update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Oct 12, 2021 -
High max 9.0
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:" (CVE-2021-40438) * httpd: mod_session: Heap overflow via a crafte…
first Oct 12, 2021 -
High max 8.2ALSA-2021:3666 8 CVEs
Important: nodejs:14 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930) * nodejs: Use-after-free on c…
first Sep 27, 2021 -
High max 6.8ALSA-2021:4135 8 CVEs
Important: java-17-openjdk security update
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689) (CVE-2021…
first Nov 9, 2021 -
High max 8.8ALSA-2021:4042 1 CVE
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133) For more details about the security issue(s), including the …
first Nov 1, 2021 -
High max 7.5ALSA-2021:3945 6 CVEs
Important: redis:6 security update
Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the da…
first Oct 20, 2021 -
High max 7.5ALBA-2019:3693 1 CVE
python-requests bug fix update
The python-requests package contains a library designed to make HTTP requests easy for developers. Bug fix: * The fix CVE-2018-18074 leads to a regression (BZ#1758261)
first Nov 5, 2019 -
High max 7.0ALSA-2021:0705 1 CVE
Important: container-tools:1.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * podman: container users permissions are not respected in privileged containers (CVE-2021-20188) For more details about the se…
first Mar 2, 2021 -
High max 8.8ALBA-2019:4268 2 CVEs
idm:DL1 bug fix update
Bug Fix(es): * IPA upgrade fails for latest ipa package when adtrust is installed (BZ#1773516)
first Dec 17, 2019 -
High max 9.6ALSA-2022:0535 7 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.6.0. Security Fix(es): * Mozilla: Extensions could have bypassed permission confirmation during update (CVE-2022-22754) * Mozilla: Memory safety bugs…
first Feb 15, 2022 -
HighALSA-2022:0495 0 CVEs
Important: .NET 5.0 security and bugfix update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Feb 9, 2022 -
High max 7.8
Important: polkit security update
The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fix(es): * polkit: Local privilege escalation in pke…
first Jan 25, 2022 -
High max 7.5ALSA-2021:5160 2 CVEs
Important: go-toolset:rhel8 security and bug fix update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716) * golang: syscall: don't close fd 0 on ForkExec erro…
first Dec 15, 2021 -
HighALSA-2022:0441 1 CVE
Important: aide security update
Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the system, and then uses that database to ensure file integrity and detect system intrusions. Security Fix(es): * aide: heap-based buffer overflow on outputs lar…
first Feb 7, 2022 -
HighALSA-2022:0418 1 CVE
Important: varnish:6 security update
Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/1 request smuggling vul…
first Feb 3, 2022 -
HighALSA-2022:0323 1 CVE
Important: nginx:1.20 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. The following packages have been upgraded to a later upstream version: nginx (1.20.1). (BZ#2031030) Security Fix(es): * n…
first Jan 31, 2022 -
High max 9.8ALSA-2022:0290 4 CVEs
Important: parfait:0.5 security update
Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot (PCP) using the Mem…
first Jan 26, 2022