6,444 results · Feed
-
HighALSA-2021:2259 1 CVE
Important: nginx:1.18 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name …
first Jun 7, 2021 -
HighALSA-2021:2170 1 CVE
Important: glib2 security and bug fix update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Securi…
first Jun 1, 2021 -
Medium max 6.5ALSA-2022:7133 1 CVE
Moderate: 389-ds:1.4 security update
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: SIGSEGV in sync_repl …
first Oct 25, 2022 -
High max 5.6ALSA-2022:7110 7 CVEs
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588) * Information leak in scsi_ioctl() (CVE-2022-0494) *…
first Oct 25, 2022 -
MediumALSA-2022:7108 2 CVEs
Moderate: sqlite security update
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the p…
first Oct 25, 2022 -
Medium max 5.3ALSA-2022:0307 12 CVEs
Moderate: java-1.8.0-openjdk security and bug fix update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934) (CVE-2022-212…
first Jan 27, 2022 -
LowALSA-2021:5238 2 CVEs
Low: virt:rhel and virt-devel:rhel security update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
first Dec 21, 2021 -
HighALSA-2021:1983 1 CVE
Important: idm:DL1 security update
AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * slapi-nis: NULL dereference (DoS) with specially crafted Bin…
first May 18, 2021 -
Medium max 6.5ALSA-2021:1972 1 CVE
Moderate: pandoc security update
Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Security Fix(es): * cmark-gfm: Exponential time to parse certain inputs could lead to DoS (CVE-2020-5238) For more details about the …
first May 18, 2021 -
LowALSA-2021:1924 1 CVE
Low: spice security update
The Simple Protocol for Independent Computing Environments (SPICE) is a remote display system built for virtual environments which allows the user to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the …
first May 18, 2021 -
HighALSA-2021:1979 1 CVE
Important: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: improper input validation may allow a trusted client to perform HTTP request smuggling (CVE-2020-25097) For more detail…
first May 18, 2021 -
Medium max 9.8ALSA-2021:1879 3 CVEs
Moderate: python38:3.8 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first May 18, 2021 -
MediumALSA-2021:1852 26 CVEs
Moderate: ghostscript security, bug fix, and enhancement update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. The following packages have been upgraded to a later upstream ve…
first May 18, 2021 -
Medium max 3.5ALSA-2021:1849 8 CVEs
Moderate: freerdp security, bug fix, and enhancement update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. The following packages have been upgraded to a l…
first May 18, 2021 -
Medium max 6.9
Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * jquery: Passing HTML containing <option> elements to manipul…
first May 18, 2021 -
UnscoredALEA-2021:1906 8 CVEs
libyang bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
first May 18, 2021 -
High max 8.8ALSA-2026:80687 4 CVEs
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as r…
first Oct 12, 2026 -
High max 9.8ALSA-2026:8052 5 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information dis…
first Apr 14, 2026 -
High max 8.2ALSA-2026:80510 1 CVE
Important: compat-openssl10 security update
The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is provided for compatibility with previous releases and software that does not support compilation with OpenSSL-1…
first Oct 12, 2026 -
High max 7.5ALSA-2026:79113 3 CVEs
Important: bind9.16 security, bug fix, and enhancement update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Oct 8, 2026 -
Medium max 7.8ALSA-2026:78951 1 CVE
Moderate: kbd security update
The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fix(es): * kbd: Local privilege escalation in openvt via incorrect process owner verification all…
first Oct 8, 2026 -
MediumALSA-2021:1811 5 CVEs
Moderate: libvncserver security update
LibVNCServer is a C library that enables you to implement VNC server functionality into own programs. Security Fix(es): * libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247) * libvncserver: buffer overflow in Connec…
first May 18, 2021 -
Medium max 7.5ALSA-2021:1796 2 CVEs
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference (CVE-2020-29652) * podman: Remote traf…
first May 18, 2021 -
High max 8.8ALSA-2022:7190 8 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.4.0. Security Fix(es): * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-…
first Oct 25, 2022 -
MediumALSA-2022:7128 1 CVE
Moderate: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625) For more details about the security issue(s), including the impact…
first Oct 25, 2022 -
High max 9.8ALSA-2022:7089 1 CVE
Important: libksba security update
KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow may lead to remote code execu…
first Oct 24, 2022 -
High max 8.1ALSA-2022:7023 1 CVE
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.3.0. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) For more details about the security issue(…
first Oct 18, 2022 -
Medium max 5.3ALSA-2022:7012 6 CVEs
Moderate: java-11-openjdk security and bug fix update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: e…
first Oct 19, 2022 -
Medium max 5.3ALSA-2022:7006 4 CVEs
Moderate: java-1.8.0-openjdk security update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJD…
first Oct 19, 2022 -
Medium max 5.3ALSA-2022:7000 6 CVEs
Moderate: java-17-openjdk security and bug fix update
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: e…
first Oct 19, 2022 -
Medium max 7.8ALSA-2022:6912 1 CVE
Moderate: .NET Core 3.1 security and bugfix update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Oct 12, 2022 -
Medium max 7.8ALSA-2022:6911 1 CVE
Moderate: .NET 6.0 security and bugfix update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Oct 12, 2022 -
Medium max 9.8ALSA-2022:7106 1 CVE
Moderate: zlib security update
The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fix(es): * zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-…
first Oct 25, 2022 -
Medium max 7.5ALSA-2022:7105 1 CVE
Moderate: gnutls security update
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509) For more det…
first Oct 25, 2022 -
High max 8.8ALSA-2022:7070 4 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.4.0 ESR. Security Fix(es): * Mozilla: Same-origin policy violation could have leaked cross-origin URLs …
first Oct 20, 2022 -
High max 8.1ALSA-2022:7024 1 CVE
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-…
first Oct 18, 2022 -
High max 9.1ALSA-2022:6964 2 CVEs
Important: nodejs:16 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16. Security Fix(es): * nodejs: weak randomnes…
first Oct 17, 2022 -
High max 8.1ALSA-2022:6878 1 CVE
Important: expat security update
Expat is a C library for parsing XML documents. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other r…
first Oct 11, 2022 -
Medium max 4.0ALSA-2021:4153 1 CVE
Moderate: dnsmasq security and bug fix update
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: fixed outgoing port used when --server is used with an interface name (CVE-2021-3448) Fo…
first Nov 9, 2021 -
MediumALSA-2021:4060 4 CVEs
Moderate: libsolv security update
The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: heap-based buffer overflow in pool_installable() in src/repo.h (CVE-2021-33928) * libsolv: heap-based buffer overflow in p…
first Nov 2, 2021