6,444 results · Feed
-
High max 8.8ALSA-2024:10832 3 CVEs
Important: postgresql:13 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 5, 2024 -
High max 8.6ALSA-2024:0748 3 CVEs
Important: container-tools:4.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: file descriptor leak ("Leaky Vessels") (CVE-2024-21626) A AlmaLinux Security Bulletin which addresses further details a…
first Feb 8, 2024 -
High max 8.8
Important: libwebp security update
The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange…
first Sep 20, 2023 -
High max 8.1ALSA-2023:3068 1 CVE
Important: mingw-expat security update
Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) For more details about the security is…
first May 16, 2023 -
Medium max 7.8ALSA-2023:3042 1 CVE
Moderate: emacs security and bug fix update
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: ctags local command execution vulnerability (C…
first May 16, 2023 -
Medium max 5.3ALSA-2023:3002 1 CVE
Moderate: bind security and bug fix update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first May 16, 2023 -
LowALSA-2023:2987 1 CVE
Low: samba security, bug fix, and enhancement update
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have be…
first May 16, 2023 -
High max 8.1ALSA-2023:2951 39 CVEs
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230, BZ#2122267) Security Fix(es): * use-after-free caused by l2cap_reassembl…
first May 16, 2023 -
Medium max 7.5ALSA-2023:2893 1 CVE
Moderate: python-mako security update
Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance. Security Fix(es): * mako: REDoS in Lexer class (CVE-2022-40023) For more details about the security issue(s), incl…
first May 16, 2023 -
Medium max 6.3ALSA-2023:2883 2 CVEs
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c (CVE-2022-3627) * libtiff: integer overflow in function TIFFReadR…
first May 16, 2023 -
Medium max 7.7ALSA-2025:10618 2 CVEs
Moderate: jq security update
jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Securi…
first Jul 8, 2025 -
Medium max 6.5ALSA-2023:7189 1 CVE
Moderate: fwupd security update
The fwupd packages provide a service that allows session software to update device firmware. Security Fix(es): * fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287) For more details about the security issue(s), including the impact, a CV…
first Nov 14, 2023 -
High max 7.5
Important: go-toolset:rhel8 security update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: net/http, x/net/http2: rapid stream resets can cause excessive work [CVE-2023-44487] (CVE-2023-39325) * HTTP/2: Multiple HTTP…
first Oct 16, 2023 -
Medium max 5.3ALSA-2023:5742 1 CVE
Moderate: java-11-openjdk security and bug fix update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more deta…
first Oct 18, 2023 -
High max 7.5
Important: dotnet6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0…
first Oct 16, 2023 -
High max 7.5
Important: dotnet7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 7.0…
first Oct 16, 2023 -
High max 9.8ALSA-2023:5790 1 CVE
Important: python-reportlab security update
Python-reportlab is a library used for generation of PDF documents. Security Fix(es): * python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450) For more details about the security issue(s), including the impact, a CVSS score, …
first Oct 17, 2023 -
Medium max 5.3ALSA-2023:5751 2 CVEs
Moderate: java-17-openjdk security and bug fix update
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path v…
first Oct 18, 2023 -
Medium max 5.3ALSA-2023:5731 3 CVEs
Moderate: java-1.8.0-openjdk security update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433) * OpenJDK: IOR deserialization issue in CORBA (8…
first Oct 18, 2023 -
Medium max 7.5
Moderate: nginx:1.22 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE…
first Oct 16, 2023 -
Medium max 7.5
Moderate: nginx:1.20 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE…
first Oct 16, 2023 -
High max 7.5ALSA-2023:5683 8 CVEs
Important: mariadb:10.5 security update
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22). Security Fix(es): * mariadb: node crashes with Transp…
first Oct 12, 2023 -
High max 8.8
Important: libvpx security update
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) * …
first Oct 9, 2023 -
High max 7.5ALSA-2023:5474 1 CVE
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Oct 5, 2023 -
HighALSA-2023:5463 1 CVE
Important: python3.11 security update
Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: …
first Oct 5, 2023 -
High max 7.5ALSA-2023:5460 1 CVE
Important: bind9.16 security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Oct 5, 2023 -
Medium max 5.5ALSA-2023:3822 1 CVE
Moderate: virt:rhel and virt-devel:rhel security and bug fix update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
first Jun 27, 2023 -
High max 7.5ALSA-2023:3781 1 CVE
Important: python38:3.8 and python38-devel:3.8 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Jun 22, 2023 -
High max 7.5ALSA-2023:3780 1 CVE
Important: python27:2.7 security update
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional…
first Jun 22, 2023 -
High max 8.1ALSA-2023:4058 1 CVE
Important: .NET 7.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet7.0 (SDK 7.0.109, Runtime 7.0.9). …
first Jul 13, 2023 -
High max 8.6ALSA-2023:4035 5 CVEs
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067) * c-ares: buffer overflow in config_sortli…
first Jul 12, 2023 -
Critical max 9.8ALSA-2023:3922 4 CVEs
Critical: go-toolset:rhel8 security update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402) * golang: cmd/go: go command ma…
first Jun 29, 2023 -
Medium max 7.0ALSA-2023:3847 1 CVE
Moderate: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466) For more details about the secur…
first Jun 27, 2023 -
MediumALSA-2023:3839 2 CVEs
Moderate: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667) * libssh: authorization bypass in p…
first Jun 27, 2023 -
Medium max 5.5ALSA-2023:3827 1 CVE
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c (CVE-2022-48281) For more details about the secu…
first Jun 27, 2023 -
Medium max 7.0ALSA-2023:3819 1 CVE
Moderate: kernel-rt security and bug fix update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dere…
first Jun 27, 2023 -
High max 7.5ALSA-2023:3811 1 CVE
Important: python39:3.9 and python39-devel:3.9 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Jun 27, 2023 -
High max 7.5ALSA-2023:3593 5 CVEs
Important: .NET 7.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Jun 14, 2023 -
HighALSA-2023:3590 2 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.12.0 ESR. Security Fix(es): * Mozilla: Click-jacking certificate exceptions through rendering lag (CVE-…
first Jun 14, 2023 -
HighALSA-2023:3588 2 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.12.0. Security Fix(es): * Mozilla: Click-jacking certificate exceptions through rendering lag (CVE-2023-34414) * Mozilla: Memory safety bugs fixed i…
first Jun 14, 2023