6,444 results · Feed
-
High max 8.8ALSA-2024:5532 1 CVE
Important: python3.11-setuptools security update
Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptool…
first Aug 19, 2024 -
High max 8.8ALSA-2024:5530 1 CVE
Important: python-setuptools security update
The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing convenient building and distribution of Python packages. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the pac…
first Aug 19, 2024 -
High max 9.8ALSA-2024:5402 10 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * Thunderbird: 115.14/128.1 () * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518) * mozilla: Out of bounds memory access in graphics sh…
first Aug 14, 2024 -
High max 7.5ALSA-2024:5390 3 CVEs
Important: bind9.16 security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Aug 14, 2024 -
Low max 5.3ALSA-2024:5338 1 CVE
Low: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176) For more details about the security issue(s), including …
first Aug 13, 2024 -
Medium max 6.5ALSA-2024:5337 1 CVE
Moderate: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Aug 13, 2024 -
Medium max 9.1ALSA-2024:5312 2 CVEs
Moderate: krb5 security update
Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the he…
first Aug 13, 2024 -
Medium max 4.4ALSA-2024:5309 1 CVE
Moderate: python-urllib3 security update
The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fix(es): * urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) For more details about t…
first Aug 13, 2024 -
Medium max 7.0ALSA-2024:5306 1 CVE
Moderate: orc security update
Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition…
first Aug 13, 2024 -
Medium max 7.5ALSA-2024:5305 1 CVE
Moderate: poppler security update
Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: pdfinfo: crash in broken documents when using -dests parameter (CVE-2024-6239) For more details about the security issue(s), inclu…
first Aug 13, 2024 -
Medium max 9.1ALSA-2024:5299 1 CVE
Moderate: wget security update
The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix(es): * wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428) For more details about the security issue(s), including the i…
first Aug 13, 2024 -
Medium max 6.5ALSA-2024:5298 1 CVE
Moderate: gnome-shell security update
GNOME Shell acts as a compositing manager for the desktop, and displays both application windows and other objects. It provides core interface functions like switching windows, launching applications, and notifications. It takes advantage of the capabilities …
first Aug 13, 2024 -
Medium max 6.0ALSA-2024:5297 3 CVEs
Moderate: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236) * edk2: Use of a…
first Aug 13, 2024 -
Medium max 7.5ALSA-2024:5294 2 CVEs
Moderate: jose security update
Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * jose: re…
first Aug 13, 2024 -
Medium max 7.5ALSA-2024:5289 1 CVE
Moderate: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: DoS when using `OIDC…
first Aug 13, 2024 -
High max 9.8ALSA-2024:5193 1 CVE
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Security issues via?backend applications whose response headers are malicious or exploitable (CVE-2024-38476) For more details abou…
first Aug 12, 2024 -
Medium max 7.5ALSA-2024:5079 4 CVEs
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209) * libtiff: Buffer Overflow v…
first Aug 7, 2024 -
High max 9.0ALSA-2024:4936 1 CVE
Important: freeradius:3.0 security update
FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: forgery attack (CVE-2024-35…
first Jul 31, 2024 -
High max 7.5ALSA-2024:4635 3 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 (CVE-2024-6604) * Mozilla: Race condition in permission assignment (CVE-2024-6601) …
first Jul 18, 2024 -
High max 8.1ALSA-2024:4620 1 CVE
Important: libndp security update
Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages. Security Fix(es): * libndp: buffer overflow in route information lengt…
first Jul 18, 2024 -
High max 8.6ALSA-2024:4617 1 CVE
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936) For …
first Jul 18, 2024 -
High max 7.5ALSA-2024:4517 3 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 (CVE-2024-6604) * Mozilla: Race co…
first Jul 11, 2024 -
High max 8.1ALSA-2024:4451 3 CVEs
Important: dotnet8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Jul 10, 2024 -
Medium max 7.5ALSA-2024:4438 1 CVE
Moderate: dotnet6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Jul 9, 2024 -
High max 7.8ALSA-2024:4420 1 CVE
Important: virt:rhel and virt-devel:rhel security update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
first Jul 9, 2024 -
Medium max 6.5ALSA-2024:4376 1 CVE
Moderate: libreswan security update
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks…
first Jul 8, 2024 -
High max 7.5ALSA-2024:4367 1 CVE
Important: pki-core security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System. Security Fix(es): * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727) For more details about the security issue(s), including t…
first Jul 8, 2024 -
High max 9.8ALSA-2024:4352 58 CVEs
Important: kernel-rt security and bug fix update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583 * kernel-rt: kernel: PCI interrupt ma…
first Jul 8, 2024 -
Low max 6.2ALSA-2024:4351 1 CVE
Low: virt:rhel and virt-devel:rhel security and bug fix update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
first Jul 8, 2024 -
Medium max 6.5ALSA-2024:4267 2 CVEs
Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: command inject…
first Jul 2, 2024 -
Medium max 4.4ALSA-2024:4265 1 CVE
Moderate: cups security update
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235) For more details about the security issue(s), including t…
first Jul 2, 2024 -
Low max 7.5ALSA-2024:4264 1 CVE
Low: openldap security update
OpenLDAP is an open-source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. Security Fix(es): * open…
first Jul 2, 2024 -
Medium max 6.0ALSA-2024:4262 1 CVE
Moderate: linux-firmware security update
The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fix(es): * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346) For more details about the secur…
first Jul 2, 2024 -
Medium max 6.2ALSA-2024:4260 1 CVE
Moderate: python-idna security update
The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture (HSA) Linux kernel driver (amdkfd). Security Fix(es): * python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651) F…
first Jul 2, 2024 -
Medium max 7.5ALSA-2024:4259 1 CVE
Moderate: xmlrpc-c security and bug fix update
XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. I…
first Jul 2, 2024 -
High max 8.6ALSA-2024:4256 2 CVEs
Important: less security update
The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security …
first Jul 2, 2024 -
Medium max 5.3ALSA-2024:4252 1 CVE
Moderate: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) For more details about the security issue(s), including the impact, a CVSS score, ackn…
first Jul 2, 2024 -
Low max 4.4ALSA-2024:4249 1 CVE
Low: c-ares security update
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629) For more details about the security issue(s), including the impac…
first Jul 2, 2024 -
Medium max 7.3ALSA-2024:4247 1 CVE
Moderate: libuv security update
libuv is a multi-platform support library with a focus on asynchronous I/O. Security Fix(es): * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806) For more details about the security issue(s), including the impact, a CVSS sc…
first Jul 2, 2024 -
Medium max 7.5ALSA-2024:4246 1 CVE
Moderate: container-tools security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain f…
first Jul 2, 2024