6,444 results · Feed
-
Medium max 7.8ALSA-2021:4201 2 CVEs
Moderate: babel security and bug fix update
Babel provides tools to build and work with gettext message catalogs, and a Python interface to the CLDR (Common Locale Data Repository), providing access to various locale display names, localized number and date formatting, etc. Security Fix(es): * python-b…
first Nov 9, 2021 -
MediumALSA-2021:4181 2 CVEs
Moderate: mutt security, bug fix, and enhancement update
Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP. The following packages have been upgraded to a later upstream …
first Nov 9, 2021 -
LowALSA-2021:4179 2 CVEs
Low: file-roller security update
File Roller is an application for creating and viewing archives files, such as tar or zip files. Security Fix(es): * file-roller: directory traversal via directory symlink pointing outside of the target directory (incomplete fix for CVE-2020-11736) (CVE-2020-…
first Nov 9, 2021 -
MediumALSA-2021:4172 1 CVE
Moderate: qt5 security, bug fix, and enhancement update
Qt is a software toolkit for developing applications. The following packages have been upgraded to a later upstream version: adwaita-qt (1.2.1), python-qt5 (5.15.0), qgnomeplatform (0.7.1), qt5 (5.15.2), qt5-qt3d (5.15.2), qt5-qtbase (5.15.2), qt5-qtconnectiv…
first Nov 9, 2021 -
Medium max 9.8ALSA-2022:7692 7 CVEs
Moderate: xmlrpc-c security update
XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. I…
first Nov 8, 2022 -
Medium max 7.5ALSA-2022:7648 6 CVEs
Moderate: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: net/http: improper sanitizat…
first Nov 8, 2022 -
Medium max 4.3ALSA-2022:7640 1 CVE
Moderate: mutt security update
Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP. Security Fix(es): * mutt: buffer overflow in uudecoder functio…
first Nov 8, 2022 -
MediumALSA-2022:7618 1 CVE
Moderate: gstreamer1-plugins-good security update
GStreamer is a streaming media framework based on graphs of filters that operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer-plug…
first Nov 8, 2022 -
MediumALSA-2022:7583 2 CVEs
Moderate: xorg-x11-server and xorg-x11-server-Xwayland security and bug fix update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x…
first Nov 8, 2022 -
LowALSA-2022:7548 1 CVE
Low: Image Builder security, bug fix, and enhancement update
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fix(es): * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, …
first Nov 8, 2022 -
Medium max 7.5ALSA-2022:7633 1 CVE
Moderate: dnsmasq security and bug fix update
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: Heap use after free in dhcp6_no_relay (CVE-2022-0934) For more details about the securit…
first Nov 8, 2022 -
Medium max 8.8ALSA-2022:7623 1 CVE
Moderate: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided a…
first Nov 8, 2022 -
MediumALSA-2022:7622 2 CVEs
Moderate: unbound security, bug fix, and enhancement update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. The following packages have been upgraded to a later upstream version: unbound (1.16.2). (BZ#2027735) Security Fix(es): * unbound: the novel ghost domain where malicious…
first Nov 8, 2022 -
Medium max 7.7ALSA-2022:7585 9 CVEs
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561) * libtiff: Null source pointer lead to Denial of Service via craft…
first Nov 8, 2022 -
LowALSA-2022:7558 1 CVE
Low: wavpack security update
WavPack is a completely open audio compression format providing lossless, high-quality lossy and a unique hybrid compression mode. Security Fix(es): * wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269) For more details about the securit…
first Nov 8, 2022 -
Medium max 5.9ALSA-2022:7524 1 CVE
Moderate: yajl security update
Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C and a small validating JSON generator. Security Fix(es): * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795…
first Nov 8, 2022 -
Medium max 7.3ALSA-2022:5319 2 CVEs
Moderate: vim security update
Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: heap buffer overflow (CVE-2022-1621) * vim: buffer over-read (CVE-2022-1629) For more details about the security issue(s), including the impact, a CVSS score, ackn…
first Jun 30, 2022 -
High max 8.8ALSA-2022:4991 1 CVE
Important: xz security update
XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time…
first Jun 13, 2022 -
HighALSA-2022:4807 1 CVE
Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a later upstream version: postgresql (12.11). Security Fix(es): * postgresql: Autovacuum, REINDEX, and others omit "security restricted…
first May 31, 2022 -
HighALSA-2022:4805 1 CVE
Important: postgresql:10 security update
PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a later upstream version: postgresql (10.21). Security Fix(es): * postgresql: Autovacuum, REINDEX, and others omit "security restricted…
first May 30, 2022 -
High max 9.8ALSA-2022:4798 1 CVE
Important: maven:3.5 security update
The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Security Fix(es): * maven-shared-utils: Command injection via Commandline class (CVE-2022-29599) For more details about the security issue(s), inclu…
first May 30, 2022 -
High max 9.8ALSA-2022:4797 1 CVE
Important: maven:3.6 security update
The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Security Fix(es): * maven-shared-utils: Command injection via Commandline class (CVE-2022-29599) For more details about the security issue(s), inclu…
first May 30, 2022 -
High max 9.0ALSA-2022:4796 1 CVE
Important: nodejs:16 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * npm: npm ci succeeds when package-lock.json doesn't match package.json (CVE-2021-43616) For more details…
first May 30, 2022 -
Critical max 8.8ALSA-2022:4776 2 CVEs
Critical: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.9.1 ESR. Security Fix(es): * Mozilla: Untrusted input used in JavaScript object indexing, leading to pro…
first May 27, 2022 -
High max 7.5ALSA-2022:2202 3 CVEs
Important: .NET Core 3.1 security, bug fix, and enhancement update
.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET Core that address a security vulnerability are now available. The updated versions ar…
first May 11, 2022 -
High max 7.5ALSA-2022:5468 1 CVE
ALSA-2022:5468: php:8.0 security update (Important)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626) For more details about the security issue(s), including the im…
first Jun 30, 2022 -
HighALSA-2022:5344 2 CVEs
Important: kernel-rt security and bug fix update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) * kernel: out-of-bound…
first Jun 28, 2022 -
HighALSA-2022:5316 2 CVEs
Important: kernel security and bug fix update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) * kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915) For mo…
first Jun 30, 2022 -
Medium max 8.1ALSA-2022:5313 4 CVEs
Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: OAUTH2 bearer bypass in connection re-use (CVE-2022-22576) * curl: credenti…
first Jun 30, 2022 -
High max 8.1ALSA-2022:4799 1 CVE
Important: rsyslog security update
The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: Heap-based overfl…
first May 30, 2022 -
High max 7.5ALSA-2022:2201 1 CVE
Important: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used…
first May 11, 2022 -
High max 7.5ALSA-2022:2200 3 CVEs
Important: .NET 5.0 security, bug fix, and enhancement update
.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET Core that address a security vulnerability are now available. The updated versions ar…
first May 11, 2022 -
MediumALSA-2022:2129 1 CVE
Moderate: lynx security update
Lynx is a text-based Web browser. Lynx does not display any images, but it does support frames, tables, and most other HTML tags. Security Fix(es): * lynx: Disclosure of HTTP authentication credentials via SNI data (CVE-2021-38165) For more details about the …
first May 10, 2022 -
Low max 4.3ALSA-2022:2081 1 CVE
Low: bluez security update
The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files. Security Fix(es): * bluez: memory leak in the SDP protocol (CVE…
first May 10, 2022 -
Medium max 5.9ALSA-2022:5311 1 CVE
Moderate: libgcrypt security update
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix(es): * libgcrypt: ElGamal implementation allows plaintext recovery (CVE-2021-40528) For more details about the security issue(s), including the im…
first Jun 30, 2022 -
High max 8.1ALSA-2022:5095 8 CVEs
Important: grub2, mokutil, shim, and shim-unsigned-x64 security update
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware de…
first Jun 16, 2022 -
Critical max 8.8ALSA-2022:4769 2 CVEs
Critical: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.1. Security Fix(es): * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution (CVE-2022-1529) * Mozilla: Proto…
first May 27, 2022 -
HighALSA-2022:2234 1 CVE
Important: subversion:1.10 security update
Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Security Fix(es): * subversion: Subversion's mod_…
first May 12, 2022 -
High max 8.8ALSA-2022:2143 1 CVE
Important: container-tools:3.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * psgo: Privilege escalation in 'podman top' (CVE-2022-1227) For more details about the security issue(s), including the impact…
first May 10, 2022 -
MediumALSA-2022:2120 1 CVE
Moderate: zsh security update
The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command-line editing, built-in spelling correction,…
first May 10, 2022