6,444 results · Feed
-
HighALSA-2022:1049 1 CVE
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling (CVE-2022-22720) For more details about the…
first Mar 24, 2022 -
Medium max 9.8ALSA-2022:0896 3 CVEs
Moderate: glibc security update
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot…
first Mar 15, 2022 -
LowALSA-2022:0889 1 CVE
Low: 389-ds:1.4 security and bug fix update
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: double free of the vi…
first Mar 15, 2022 -
MediumALSA-2022:0886 2 CVEs
Moderate: virt:rhel and virt-devel:rhel security update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
first Mar 15, 2022 -
High max 9.8
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.7.0. Security Fix(es): * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485) * Mozilla: Use-after-free in WebGPU IPC Framework (CVE…
first Mar 14, 2022 -
High max 7.5ALSA-2022:0826 2 CVEs
Important: .NET 6.0 security and bugfix update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address security vulnerabilities are now available. The updated versions are .NET SDK…
first Mar 10, 2022 -
Medium max 8.4ALSA-2022:0894 6 CVEs
Moderate: vim security update
Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Heap-based buffer overflow in block_insert() in src/ops.c (CVE-2022-0261) * vim: Heap-based buffer overflow in utf_head_off() in mbyte.c (CVE-2022-0318) * vim: Hea…
first Mar 15, 2022 -
MediumALSA-2022:0892 2 CVEs
Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, a…
first Mar 15, 2022 -
High max 7.5ALSA-2022:0830 3 CVEs
Important: .NET 5.0 security and bugfix update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address security vulnerabilities are now available. The updated versions are .NET SDK…
first Mar 10, 2022 -
High max 7.8
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888) Security Fix(es): * kernel: improper initialization of the "flags" membe…
first Mar 10, 2022 -
Medium max 7.0ALSA-2022:0672 3 CVEs
Moderate: ruby:2.5 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) * ruby: FTP PASV …
first Feb 24, 2022 -
High max 8.8ALSA-2022:0545 1 CVE
Important: ruby:2.5 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a diffe…
first Feb 16, 2022 -
Critical max 9.8
Critical: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.7.0 ESR. Security Fix(es): * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485) * Moz…
first Mar 10, 2022 -
HighALSA-2022:0658 1 CVE
Important: cyrus-sasl security update
The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer (SASL). SASL is a method for adding authentication support to connection-based protocols. Security Fix(es): * cyrus-sasl: failure to properly escape SQL input…
first Feb 23, 2022 -
High max 8.8ALSA-2022:0543 6 CVEs
Important: ruby:2.6 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a diffe…
first Feb 16, 2022 -
High max 8.8ALSA-2021:4916 1 CVE
Important: mailman:2.1 security update
Mailman is a program used to help manage e-mail discussion lists. Security Fix(es): * mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227) For more details about the security issue(s), including the impact, a CVSS scor…
first Dec 2, 2021 -
CriticalALSA-2021:4903 1 CVE
Critical: nss security update
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fix(es): * nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)…
first Dec 1, 2021 -
HighALSA-2021:4826 2 CVEs
Important: mailman:2.1 security update
Mailman is a program used to help manage e-mail discussion lists. Security Fix(es): * mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097) * mailman: CSRF token derived from admin password allows offline brute-force …
first Nov 23, 2021 -
MediumALSA-2021:4743 1 CVE
Moderate: llvm-toolset:rhel8 security update
LLVM Toolset provides the LLVM compiler infrastructure framework, the Clang compiler for the C and C++ languages, the LLDB debugger, and related tools for code analysis. Security Fix(es): * Developer environment: Unicode's bidirectional (BiDi) override charac…
first Nov 18, 2021 -
HighALSA-2021:4647 2 CVEs
Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Insufficient validation of user-supplied sizes for the MSG_CRYPTO message type (CVE-2021-43267) * kernel: timer tree corruption leads to missing …
first Nov 15, 2021 -
High max 5.8ALSA-2021:4622 2 CVEs
Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: improper client inp…
first Nov 11, 2021 -
MediumALSA-2021:4595 1 CVE
Moderate: binutils security update
The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Securit…
first Nov 10, 2021 -
MediumALSA-2021:4649 1 CVE
Moderate: gcc-toolset-10-binutils security update
The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Securit…
first Nov 15, 2021 -
MediumALSA-2021:4321 1 CVE
Moderate: linuxptp security, bug fix, and enhancement update
The linuxptp packages provide Precision Time Protocol (PTP) implementation for Linux according to IEEE standard 1588 for Linux. The dual design goals are to provide a robust implementation of the standard and to use the most relevant and modern Application Pr…
first Nov 9, 2021 -
Medium max 6.5ALSA-2021:4292 7 CVEs
Moderate: squid:4 security, bug fix, and enhancement update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. The following packages have been upgraded to a later upstream version: squid (4.15). (BZ#1964384) Security Fix(es): * squid: denial of service in …
first Nov 9, 2021 -
Medium max 5.5ALSA-2021:4222 1 CVE
Moderate: container-tools:3.0 security and bug fix update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602) For more details ab…
first Nov 9, 2021 -
Medium max 5.5ALSA-2021:4221 1 CVE
Moderate: container-tools:2.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602) For more details ab…
first Nov 9, 2021 -
MediumALSA-2021:4191 7 CVEs
Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
first Nov 9, 2021 -
MediumALSA-2021:4339 1 CVE
Moderate: grilo security update
Grilo is a framework that provides access to different sources of multimedia content, using a pluggable system. The grilo package contains the core library and elements. Security Fix(es): * grilo: missing TLS certificate verification (CVE-2021-39365) For more…
first Nov 9, 2021 -
MediumALSA-2021:4326 1 CVE
Moderate: libX11 security update
The libX11 packages contain the core X11 protocol client library. Security Fix(es): * libX11: missing request length checks (CVE-2021-31535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related i…
first Nov 9, 2021 -
Medium max 7.5ALSA-2021:4324 1 CVE
Moderate: python-psutil security update
psutil is a module providing an interface for retrieving information on all running processes and system utilization (CPU, memory, disks, network, users) in a portable way by using Python. Security Fix(es): * python-psutil: double free because of refcount mis…
first Nov 9, 2021 -
MediumALSA-2021:4315 1 CVE
Moderate: spamassassin security update
The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email. Security Fix(es): * spamassassin: Malicious rule configuration files can be configured to run system commands (CVE-2020-1946) For more details about the se…
first Nov 9, 2021 -
MediumALSA-2021:4270 1 CVE
Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update
Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. The following packages have been upgraded to a later upstream version: rust (1.54.0). (BZ#1945805) Security Fix(es): * rus…
first Nov 9, 2021 -
MediumALSA-2021:4256 1 CVE
Moderate: graphviz security update
Graphviz is open-source graph-visualization software. Graph visualization is a way of representing structural information as diagrams of abstract graphs and networks. It has important applications in networking, bioinformatics, software engineering, database …
first Nov 9, 2021 -
MediumALSA-2021:4251 14 CVEs
Moderate: openjpeg2 security update
OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages have been upgraded to a later upstream version: openjpeg2 (2.4.0). Security Fix(es): * openjpeg: use-after-free and double-free via a mix of vali…
first Nov 9, 2021 -
LowALSA-2021:4236 1 CVE
Low: tcpdump security and bug fix update
The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces. Security Fix(es): * tcpdump: ppp decapsulator can be convin…
first Nov 9, 2021 -
MediumALSA-2021:4235 4 CVEs
Moderate: jasper security update
JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Security Fix(es): * jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828) * jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021…
first Nov 9, 2021 -
MediumALSA-2021:4231 8 CVEs
Moderate: libwebp security update
The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange…
first Nov 9, 2021 -
Medium max 8.2ALSA-2021:4226 5 CVEs
Moderate: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191) Security Fix(es): * golang: crypto/elliptic: inc…
first Nov 9, 2021 -
Medium max 5.4ALSA-2021:4213 5 CVEs
Moderate: php:7.4 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php (7.4.19). (BZ#1944110) Security Fix(es): * php: Wrong ciphertext/tag in AES-CCM encryption for a 1…
first Nov 9, 2021