2,038 results · Clear filters · Feed
-
Medium max 6.5ALSA-2024:5337 1 CVE
Moderate: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Aug 13, 2024 -
Medium max 9.1ALSA-2024:5312 2 CVEs
Moderate: krb5 security update
Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the he…
first Aug 13, 2024 -
Medium max 4.4ALSA-2024:5309 1 CVE
Moderate: python-urllib3 security update
The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fix(es): * urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) For more details about t…
first Aug 13, 2024 -
Medium max 7.0ALSA-2024:5306 1 CVE
Moderate: orc security update
Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition…
first Aug 13, 2024 -
Medium max 7.5ALSA-2024:5305 1 CVE
Moderate: poppler security update
Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: pdfinfo: crash in broken documents when using -dests parameter (CVE-2024-6239) For more details about the security issue(s), inclu…
first Aug 13, 2024 -
Medium max 9.1ALSA-2024:5299 1 CVE
Moderate: wget security update
The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix(es): * wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428) For more details about the security issue(s), including the i…
first Aug 13, 2024 -
Medium max 6.5ALSA-2024:5298 1 CVE
Moderate: gnome-shell security update
GNOME Shell acts as a compositing manager for the desktop, and displays both application windows and other objects. It provides core interface functions like switching windows, launching applications, and notifications. It takes advantage of the capabilities …
first Aug 13, 2024 -
Medium max 6.0ALSA-2024:5297 3 CVEs
Moderate: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236) * edk2: Use of a…
first Aug 13, 2024 -
Medium max 7.5ALSA-2024:5294 2 CVEs
Moderate: jose security update
Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * jose: re…
first Aug 13, 2024 -
Medium max 7.5ALSA-2024:5289 1 CVE
Moderate: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: DoS when using `OIDC…
first Aug 13, 2024 -
Medium max 7.5ALSA-2024:5079 4 CVEs
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209) * libtiff: Buffer Overflow v…
first Aug 7, 2024 -
Medium max 7.5ALSA-2024:4438 1 CVE
Moderate: dotnet6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Jul 9, 2024 -
Medium max 6.5ALSA-2024:4376 1 CVE
Moderate: libreswan security update
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks…
first Jul 8, 2024 -
Medium max 6.5ALSA-2024:4267 2 CVEs
Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: command inject…
first Jul 2, 2024 -
Medium max 4.4ALSA-2024:4265 1 CVE
Moderate: cups security update
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235) For more details about the security issue(s), including t…
first Jul 2, 2024 -
Medium max 6.0ALSA-2024:4262 1 CVE
Moderate: linux-firmware security update
The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fix(es): * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346) For more details about the secur…
first Jul 2, 2024 -
Medium max 6.2ALSA-2024:4260 1 CVE
Moderate: python-idna security update
The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture (HSA) Linux kernel driver (amdkfd). Security Fix(es): * python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651) F…
first Jul 2, 2024 -
Medium max 7.5ALSA-2024:4259 1 CVE
Moderate: xmlrpc-c security and bug fix update
XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. I…
first Jul 2, 2024 -
Medium max 5.3ALSA-2024:4252 1 CVE
Moderate: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) For more details about the security issue(s), including the impact, a CVSS score, ackn…
first Jul 2, 2024 -
Medium max 7.3ALSA-2024:4247 1 CVE
Moderate: libuv security update
libuv is a multi-platform support library with a focus on asynchronous I/O. Security Fix(es): * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806) For more details about the security issue(s), including the impact, a CVSS sc…
first Jul 2, 2024 -
Medium max 7.5ALSA-2024:4246 1 CVE
Moderate: container-tools security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain f…
first Jul 2, 2024 -
Medium max 6.3ALSA-2024:4245 1 CVE
Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Jul 2, 2024 -
Medium max 6.3ALSA-2024:4244 1 CVE
Moderate: python3.11-PyMySQL security update
This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython. Security Fix(es): * python-pymysql: SQL injection if used with untrusted JSON input (CVE…
first Jul 2, 2024 -
Medium max 6.2ALSA-2024:4243 1 CVE
Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Jul 2, 2024 -
Medium max 6.5ALSA-2024:4242 1 CVE
Moderate: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and p…
first Jul 2, 2024 -
Medium max 5.9ALSA-2024:4241 2 CVEs
Moderate: iperf3 security update
Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: possible denial of service (CVE-2023-7250) * iperf3: vulnerable…
first Jul 2, 2024 -
Medium max 9.8ALSA-2024:4237 2 CVEs
Moderate: go-toolset security update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) * golang: net/netip: Unexpected behavior from Is method…
first Jul 2, 2024 -
Medium max 5.4ALSA-2024:4231 1 CVE
Moderate: python-jinja2 security update
The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Security Fix(es): * jinja2: accepts keys containing no…
first Jul 2, 2024 -
Medium max 6.7ALSA-2024:4227 1 CVE
Moderate: python-pillow security update
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es): * python-pillow: buffer overflow in _imagingc…
first Jul 2, 2024 -
Medium max 7.3ALSA-2024:4197 1 CVE
Moderate: httpd:2.4/httpd security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd:2.4: httpd: HTTP response splitting (CVE-2023-38709) For more details about the security issue(s), including the impact, a CVSS scor…
first Jul 1, 2024 -
Medium max 4.9ALSA-2024:3968 2 CVEs
Moderate: container-tools:rhel8 bug fix and enhancement update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180) * buildah: jose-go: improper handling of highly…
first Jun 18, 2024 -
Medium max 8.8ALSA-2024:3784 6 CVEs
Moderate: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.11.0. Security Fix(es): * firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) * firefox: IndexedDB files retained in private browsing …
first Jun 10, 2024 -
Medium max 8.8ALSA-2024:3783 6 CVEs
Moderate: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.11.0 ESR. Security Fix(es): * firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) * firef…
first Jun 10, 2024 -
Medium max 9.8ALSA-2024:3670 3 CVEs
Moderate: ruby:3.3 security, bug fix, and enhancement update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.3). (AlmaLinux-37446) Securit…
first Jun 6, 2024 -
Medium max 7.3ALSA-2024:3667 1 CVE
Moderate: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: command injectio…
first Jun 6, 2024 -
Medium max 7.5ALSA-2024:3626 1 CVE
Moderate: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: use-after-free in XMLReader (CVE-2024-25062) For more details about the security issue(s), including the impact, a CVSS score, ack…
first Jun 5, 2024 -
Medium max 9.8ALSA-2024:3546 3 CVEs
Moderate: ruby:3.1 security, bug fix, and enhancement update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Buffer overr…
first Jun 3, 2024 -
Medium max 9.8ALSA-2024:3500 6 CVEs
Moderate: ruby:3.0 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerabilit…
first May 30, 2024 -
Medium max 7.8ALSA-2024:3341 1 CVE
Moderate: gdk-pixbuf2 security update
The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf2: heap memory corruption on gdk-pixbuf (CVE-2022-48622) Fo…
first May 23, 2024 -
Medium max 7.0ALSA-2024:3275 1 CVE
Moderate: python-dns security update
The python-dns package contains the dnslib module that implements a DNS client and additional modules that define certain symbolic constants used by DNS, such as dnstype, dnsclass and dnsopcode. Security Fix(es): * dnspython: denial of service in stub resolve…
first May 22, 2024