2,038 results · Clear filters · Feed
-
MediumALSA-2023:2592 1 CVE
Moderate: golang-github-cpuguy83-md2man security, bug fix, and enhancement update
go-md2man converts markdown into roff (man pages). Security Fix(es): * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other re…
first May 9, 2023 -
Medium max 6.5ALSA-2023:2487 4 CVEs
Moderate: fwupd security and bug fix update
The fwupd packages provide a service that allows session software to update device firmware. Security Fix(es): * fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34301) * shim:…
first May 9, 2023 -
Medium max 5.5ALSA-2023:2453 2 CVEs
Moderate: libtpms security update
The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines. Security Fix(es): * tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017) * tpm2: TCG TPM2.0 implementations vulnerable to memory co…
first May 9, 2023 -
Medium max 6.5ALSA-2023:2444 2 CVEs
Moderate: net-snmp security and bug fix update
The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP t…
first May 9, 2023 -
Medium max 7.5ALSA-2023:2357 10 CVEs
Moderate: git-lfs security and bug fix update
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang: net/http: improper sanitization of Transfer-…
first May 9, 2023 -
Medium max 5.9ALSA-2023:2650 1 CVE
Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: FTP too eager connection reuse (CVE-2023-27535) For more details about the …
first May 9, 2023 -
MediumALSA-2023:2645 1 CVE
Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: the functions order_hostkeyalgs() and list…
first May 9, 2023 -
MediumALSA-2023:2589 1 CVE
Moderate: autotrace security update
AutoTrace is a program for converting bitmaps to vector graphics. Security Fix(es): * autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323) For more details about the security issue(s), including the impact, a CVSS score, acknowl…
first May 9, 2023 -
Medium max 6.5ALSA-2023:2502 2 CVEs
Moderate: dhcp security and enhancement update
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay…
first May 9, 2023 -
MediumALSA-2023:2459 1 CVE
Moderate: device-mapper-multipath security and bug fix update
The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2…
first May 9, 2023 -
Medium max 4.7ALSA-2023:2378 1 CVE
Moderate: postgresql-jdbc security update
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * postgresql-jdbc: Information leak of prepared statement d…
first May 9, 2023 -
Medium max 7.5ALSA-2023:2370 1 CVE
Moderate: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: NRDelegation attack leads to uncontrolled resource consumption (Non-Responsive Delegation Attack) (CVE-2022-3204) For more details about the…
first May 9, 2023 -
Medium max 5.3ALSA-2023:2367 2 CVEs
Moderate: containernetworking-plugins security and bug fix update
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity …
first May 9, 2023 -
Medium max 7.7ALSA-2023:2340 10 CVEs
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap Buffer overflows in tiffcrop.c (CVE-2022-3570) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix (CVE…
first May 9, 2023 -
Medium max 5.9ALSA-2023:2326 9 CVEs
Moderate: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: clients using `/par…
first May 9, 2023 -
MediumALSA-2023:2293 1 CVE
Moderate: pki-core security, bug fix, and enhancement update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System. Security Fix(es): * pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subj…
first May 9, 2023 -
Medium max 8.5ALSA-2023:2319 4 CVEs
Moderate: git security and bug fix update
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision histor…
first May 9, 2023 -
Medium max 5.3ALSA-2023:2253 2 CVEs
Moderate: buildah security and bug fix update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
first May 9, 2023 -
Medium max 8.8ALSA-2023:2249 9 CVEs
Moderate: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c (CVE-2022-3550) * xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283) * xorg-x11-server: XTestSwa…
first May 9, 2023 -
Medium max 7.5ALSA-2023:2236 3 CVEs
Moderate: toolbox security and bug fix update
Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fix(es): * golang: net/http: handle server errors after s…
first May 9, 2023 -
MediumALSA-2023:2216 2 CVEs
Moderate: gdk-pixbuf2 security update
The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf: heap-buffer overflow when decoding the lzw compressed str…
first May 9, 2023 -
Medium max 7.5ALSA-2023:2204 5 CVEs
Moderate: Image Builder security, bug fix, and enhancement update
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fix(es): * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879) * golang: net/h…
first May 9, 2023 -
MediumALSA-2023:2202 1 CVE
Moderate: frr security, bug fix, and enhancement update
FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. The following packages have been upgraded to a later upstream version: frr (8.3.1). (BZ#2129731) Securit…
first May 9, 2023 -
Medium max 7.5ALSA-2023:2177 1 CVE
Moderate: grafana-pcp security and enhancement update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: net/http: handle server erro…
first May 9, 2023 -
Medium max 7.5ALSA-2023:2166 3 CVEs
Moderate: freeradius security and bug fix update
FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: Information leakage in EAP-…
first May 9, 2023 -
Medium max 5.3ALSA-2023:2283 2 CVEs
Moderate: skopeo security and bug fix update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE…
first May 9, 2023 -
Medium max 5.3ALSA-2023:2282 2 CVEs
Moderate: podman security and bug fix update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang: net/http: excessive memory growth in a …
first May 9, 2023 -
MediumALSA-2023:2260 7 CVEs
Moderate: gstreamer1-plugins-good security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer-plu…
first May 9, 2023 -
MediumALSA-2023:2259 1 CVE
Moderate: poppler security and bug fix update
Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: integer overflow in JBIG2 decoder using malformed files (CVE-2022-38784) For more details about the security issue(s), including t…
first May 9, 2023 -
Medium max 8.8ALSA-2023:2257 6 CVEs
Moderate: tigervnc security and bug fix update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
first May 9, 2023 -
Medium max 7.5ALSA-2023:2193 2 CVEs
Moderate: butane security, bug fix, and enhancement update
Butane translates human-readable Butane Configs into machine-readable Ignition configs for provisioning operating systems that use Ignition. The following packages have been upgraded to a later upstream version: butane (0.16.0). (BZ#2135475) Security Fix(es):…
first May 9, 2023 -
Medium max 6.5ALSA-2023:2162 2 CVEs
Moderate: qemu-kvm security, bug fix, and enhancement update
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. The following packages have been upgraded to a late…
first May 9, 2023 -
Medium max 7.0ALSA-2024:10869 5 CVEs
Moderate: redis:7 security update
Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the da…
first Dec 5, 2024 -
Medium max 7.8ALSA-2024:10274 3 CVEs
Moderate: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009) * kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244) * kernel: cxl/…
first Nov 26, 2024 -
Medium max 7.5ALSA-2023:2312 1 CVE
Moderate: jackson security update
Jackson is a suite of data-processing tools for Java, including the flagship streaming JSON parser / generator library, matching data-binding library, and additional modules to process data encoded in various other data formats. Security Fix(es): * jackson-da…
first May 9, 2023 -
Medium max 7.5ALSA-2023:2258 1 CVE
Moderate: python-mako security update
Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance. Security Fix(es): * python-mako: REDoS in Lexer class (CVE-2022-40023) For more details about the security issue(s…
first May 9, 2023 -
Medium max 8.8ALSA-2023:2248 9 CVEs
Moderate: xorg-x11-server security and bug fix update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.…
first May 9, 2023 -
Medium max 7.0ALSA-2023:2234 1 CVE
Moderate: sysstat security and bug fix update
The sysstat packages provide the sar and iostat commands. These commands enable system monitoring of disk, network, and other I/O activity. Security Fix(es): * sysstat: arithmetic overflow in allocate_structures() on 32 bit systems (CVE-2022-39377) For more d…
first May 9, 2023 -
Medium max 6.7ALSA-2023:2179 5 CVEs
Moderate: libguestfs-winsupport security update
The libguestfs-winsupport package adds support for Windows guests to libguestfs, a set of tools and libraries allowing users to access and modify virtual machine (VM) disk images. Security Fix(es): * ntfs-3g: heap-based buffer overflow in ntfsck (CVE-2021-467…
first May 9, 2023 -
Medium max 6.5ALSA-2023:1701 1 CVE
Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: HTTP multi-header compression denial of service (CVE-2023-23916) For more d…
first Apr 11, 2023