6,444 results · Feed
-
LowALSA-2022:2110 1 CVE
Low: grub2 security, bug fix, and enhancement update
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware de…
first May 10, 2022 -
High max 8.8ALSA-2022:5597 1 CVE
Important: pandoc security update
Pandoc is a markdown/markup conversion tool. The version of pandoc in AlmaLinux 8 CRB uses cmark-gfm (GitHub's extended version of the C reference implementation of CommonMark) for parts of its conversion. The update, fixes CVE-2022-24724: an integer overflow…
first Jul 18, 2022 -
HighALSA-2022:5565 1 CVE
Important: kernel-rt security and bug fix update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729) For more…
first Jul 13, 2022 -
HighALSA-2022:5564 1 CVE
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729) For more details about the security issue(s), including the impac…
first Jul 13, 2022 -
HighALSA-2022:5526 1 CVE
Important: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: DoS when processing gopher server responses (CVE-2021-46784) For more details about the security issue(s), including th…
first Jul 7, 2022 -
Medium max 7.5ALSA-2022:5314 2 CVEs
Moderate: expat security update
Expat is a C library for parsing XML documents. Security Fix(es): * expat: stack exhaustion in doctype parsing (CVE-2022-25313) * expat: integer overflow in copyString() (CVE-2022-25314) For more details about the security issue(s), including the impact, a CV…
first Jun 30, 2022 -
High max 7.5ALSA-2022:4661 1 CVE
Important: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * sinatra: path traversal possible outside of public_dir when serving static files (CVE-2022-29970) For more details about the security is…
first May 18, 2022 -
High max 7.5ALSA-2022:2199 3 CVEs
Important: .NET 6.0 security, bug fix, and enhancement update
.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET Core that address a security vulnerability are now available. The updated versions ar…
first May 11, 2022 -
Medium max 5.3ALSA-2022:2092 1 CVE
Moderate: bind security, bug fix, and enhancement update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first May 10, 2022 -
High max 8.8ALSA-2026:A004 1 CVE
Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS…
first May 8, 2026 -
High max 8.2ALSA-2026:92323 2 CVEs
Important: expat security update
Expat is a C library for parsing XML documents. Security Fix(es): * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) Fo…
-
High max 9.3ALSA-2026:92208 4 CVEs
Important: kernel-rt security, bug fix, and enhancement update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2…
-
Low max 7.5ALSA-2022:5326 1 CVE
Low: compat-openssl10 security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. compat-openssl10 provides the legacy 1.0 version of OpenSSL for use with older b…
first Jun 30, 2022 -
Medium max 5.2ALSA-2022:1766 3 CVEs
Moderate: libreoffice security, bug fix, and enhancement update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and p…
first May 10, 2022 -
Medium max 8.2ALSA-2022:1764 4 CVEs
Moderate: python38:3.8 and python38-devel:3.8 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first May 10, 2022 -
High max 9.8ALSA-2022:1730 8 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.0. Security Fix(es): * Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909) * Mozilla: iframe Sandbox bypass (CVE-2022…
first May 5, 2022 -
High max 9.8ALSA-2022:1705 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.9.0 ESR. Security Fix(es): * Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-…
first May 4, 2022 -
High max 9.8ALSA-2022:1643 1 CVE
Important: xmlrpc-c security update
XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. I…
first Apr 28, 2022 -
Medium max 7.5ALSA-2021:4173 12 CVEs
Moderate: exiv2 security, bug fix, and enhancement update
Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats. The fol…
first Nov 9, 2021 -
MediumALSA-2021:4325 1 CVE
Moderate: lasso security and enhancement update
The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple la…
first Nov 9, 2021 -
Medium max 7.5ALSA-2021:4319 3 CVEs
Moderate: compat-exiv2-026 security update
Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats. Securit…
first Nov 9, 2021 -
LowALSA-2021:4316 1 CVE
Low: zziplib security update
The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: infinite loop via the return value of zzip_file_read() as used in unzzip_cat_file() (CVE-2020-18442) For more details about the security issue(s), includi…
first Nov 9, 2021 -
MediumALSA-2021:4257 2 CVEs
Moderate: httpd:2.4 security, bug fix, and enhancement update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690) * httpd: Unexpected URL matching with 'MergeSlash…
first Nov 9, 2021 -
MediumALSA-2021:4241 4 CVEs
Moderate: libtiff security and bug fix update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Integer overflow in tif_getimage.c (CVE-2020-35523) * libtiff: Heap-based buffer overflow in TIFF2PDF tool (CVE-2020-35524…
first Nov 9, 2021 -
Medium max 7.5ALSA-2021:4198 2 CVEs
Moderate: edk2 security, bug fix, and enhancement update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. The following packages have been upgraded to a later upstream version: edk2 (20210527gite1999b264f1f…
first Nov 9, 2021 -
Medium max 5.3ALSA-2021:4161 1 CVE
Moderate: python-jinja2 security update
The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Security Fix(es): * python-jinja2: ReDoS vulnerability…
first Nov 9, 2021 -
Medium max 7.8ALSA-2021:4151 8 CVEs
Moderate: python27:2.7 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Nov 9, 2021 -
Medium max 9.8ALSA-2021:2583 2 CVEs
Moderate: python38:3.8 and python38-devel:3.8 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Jun 29, 2021 -
MediumALSA-2021:2575 1 CVE
Moderate: lz4 security update
The lz4 packages provide support for LZ4, a very fast, lossless compression algorithm that provides compression speeds of 400 MB/s per core and scales with multicore CPUs. It also features an extremely fast decoder that reaches speeds of multiple GB/s per cor…
first Jun 29, 2021 -
High max 8.8ALEA-2021:4539 1 CVE
flatpak bug fix and enhancement update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Bug Fix(es) and Enhancement(s): * CVE-2021-41133 flatpak: sandbox bypass via recent VFS-manipulating syscalls (BZ#2012868)
first Nov 9, 2021 -
High max 6.5ALSA-2021:2570 2 CVEs
Important: kernel security and bug fix update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan (CVE-2021-33034) * kernel: security bypass in certs/blacklist.c and certs…
first Jun 29, 2021 -
HighALSA-2021:2375 3 CVEs
Important: postgresql:13 security update
PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a later upstream version: postgresql (13.3). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array subscripting…
first Jun 10, 2021 -
High max 7.6ALSA-2021:2370 1 CVE
Important: container-tools:3.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: vulnerable to symlink exchange attack (CVE-2021-30465) For more details about the security issue(s), including the impa…
first Jun 10, 2021 -
HighALSA-2021:2360 2 CVEs
Important: postgresql:9.6 security update
PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a later upstream version: postgresql (9.6.22) Security Fix(es): * postgresql: Buffer overrun from integer overflow in array subscriptin…
first Jun 9, 2021 -
High max 7.6ALSA-2021:2291 1 CVE
Important: container-tools:2.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: vulnerable to symlink exchange attack (CVE-2021-30465) For more details about the security issue(s), including the impa…
first Jun 8, 2021 -
Medium max 8.8ALSA-2021:2569 5 CVEs
Moderate: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516) * libxml2: Heap-based buffer overflow in xmlEncodeEnti…
first Jun 29, 2021 -
HighALSA-2021:2372 4 CVEs
Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a later upstream version: postgresql (12.7) Security Fix(es): * postgresql: Buffer overrun from integer overflow in array subscripting …
first Jun 10, 2021 -
High max 7.6ALSA-2021:2371 1 CVE
Important: container-tools:rhel8 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: vulnerable to symlink exchange attack (CVE-2021-30465) For more details about the security issue(s), including the impa…
first Jun 10, 2021 -
HighALSA-2021:2363 1 CVE
Important: gupnp security update
GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible. Security Fix(es): * gupnp: allows DNS rebinding which …
first Jun 9, 2021 -
HighALSA-2021:2290 1 CVE
Important: nginx:1.16 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name …
first Jun 8, 2021