6,444 results · Feed
-
MediumALSA-2020:4443 1 CVE
Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, a…
first Nov 3, 2020 -
Medium max 5.8ALSA-2020:3032 2 CVEs
Moderate: mod_auth_openidc:2.3 security and bug fix update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: Open redirect in log…
first Jul 21, 2020 -
High max 5.6ALSA-2020:2852 4 CVEs
Important: nodejs:12 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (12.18.2). Security Fix(es): * nghttp2: overly…
first Jul 7, 2020 -
MediumALSA-2021:1627 3 CVEs
Moderate: trousers security, bug fix, and enhancement update
TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. TrouSerS enables the user to write applications that make use of the Trusted Platform Module (TPM) hardware. The following packages have been upgraded to a late…
first May 18, 2021 -
Medium max 8.6ALSA-2021:1598 1 CVE
Moderate: bluez security update
The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files. Security Fix(es): * bluez: double free in gatttool client disco…
first May 18, 2021 -
MediumALSA-2020:4712 1 CVE
Moderate: subversion:1.10 security update
Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Security Fix(es): * subversion: remotely triggera…
first Nov 3, 2020 -
MediumALSA-2020:3654 1 CVE
Moderate: libcroco security update
The libcroco is a standalone Cascading Style Sheet level 2 (CSS2) parsing and manipulation library. Security Fix(es): * libcroco: Stack overflow in function cr_parser_parse_any_core in cr-parser.c (CVE-2020-12825) For more details about the security issue(s),…
first Sep 8, 2020 -
UnscoredALEA-2021:1580 1 CVE
libarchive bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
first May 18, 2021 -
Medium max 6.5ALSA-2020:4682 8 CVEs
Moderate: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have been upgraded to a later upstream version: grafana (6.7.4). (BZ#1807323) Security Fix(es): * grafana: XSS vulnerability v…
first Nov 3, 2020 -
MediumALSA-2020:4659 3 CVEs
Moderate: gd security update
GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. Security Fix(es): * gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019…
first Nov 3, 2020 -
LowALSA-2020:4649 1 CVE
Low: evolution security and bug fix update
Evolution is a GNOME application that provides integrated email, calendar, contact management, and communications functionality. The evolution-data-server packages provide a unified back end for applications which interact with contacts, tasks and calendar in…
first Nov 3, 2020 -
MediumALSA-2020:4629 4 CVEs
Moderate: libvpx security update
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2…
first Nov 3, 2020 -
High max 3.7ALSA-2020:2755 1 CVE
Important: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080) For more details about the security issue(s), including the impac…
first Jun 25, 2020 -
Medium max 7.5ALSA-2020:4694 3 CVEs
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749) * QEMU: slir…
first Nov 3, 2020 -
High max 7.7ALSA-2020:3176 1 CVE
Important: postgresql-jdbc security update
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * postgresql-jdbc: XML external entity (XXE) vulnerability …
first Jul 28, 2020 -
MediumALSA-2020:1852 1 CVE
Moderate: patch security and bug fix update
The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to the file. A person who has the original file can then use the patch command with the diff file to add the chan…
first Apr 28, 2020 -
MediumALSA-2020:1880 1 CVE
Moderate: ibus and glib2 security and bug fix update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. The In…
first Apr 28, 2020 -
MediumALSA-2020:1665 3 CVEs
Moderate: qt5 security, bug fix, and enhancement update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. The following packages have been upgraded to a later upstream version: qt5 (5.12.5), qt5-qt3d (5.12.5), qt5-qtbase (5.1…
first Apr 28, 2020 -
High max 7.5ALBA-2019:3384 5 CVEs
ruby:2.5 bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
first Nov 5, 2019 -
High max 8.8ALSA-2020:1931 1 CVE
Important: container-tools:2.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) For more details…
first Apr 28, 2020 -
MediumALSA-2020:1708 4 CVEs
Moderate: liblouis security and bug fix update
Liblouis is an open source braille translator and back-translator named in honor of Louis Braille. It features support for computer and literary braille, supports contracted and uncontracted translation for many languages and has support for hyphenation. New …
first Apr 28, 2020 -
MediumALSA-2020:1653 1 CVE
Moderate: zziplib security update
The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828) For more details about the security issue(s), including the impact, a CVSS …
first Apr 28, 2020 -
High max 6.8ALSA-2021:3893 11 CVEs
Important: java-1.8.0-openjdk security and bug fix update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565) * OpenJDK: Inc…
first Oct 20, 2021 -
High max 8.2ALSA-2021:3623 8 CVEs
Important: nodejs:12 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930) * nodejs: Use-after-free on c…
first Sep 21, 2021 -
HighALSA-2020:5393 1 CVE
Important: libexif security update
The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: out of bounds write due to an integer overflow in exif-entry.c (CVE-2020-0452) For more details about the security issue(s), including the i…
first Dec 14, 2020 -
Medium max 4.8ALSA-2020:1624 17 CVEs
Moderate: php:7.2 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php (7.2.24). (BZ#1726981) Security Fix(es): * php: Invalid memory access in function xmlrpc_decode() …
first Apr 28, 2020 -
HighALSA-2020:1379 1 CVE
Important: container-tools:rhel8 security and bug fix update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608) For more details about the security issue(s…
first Apr 7, 2020 -
HighALSA-2020:1317 1 CVE
Important: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531) For more details about the security …
first Apr 6, 2020 -
HighALSA-2020:0903 1 CVE
Important: zsh security update
The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command-line editing, built-in spelling correction,…
first Mar 19, 2020 -
HighALSA-2020:0598 3 CVEs
Important: nodejs:12 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (12.16.1). Security Fix(es): * nodejs: HTTP re…
first Feb 25, 2020 -
Medium max 9.8ALSA-2019:3335 6 CVEs
Moderate: python27:2.7 security and bug fix update
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. Security Fix(es): * numpy: crafted serialized object passed in numpy.load() in pickle py…
first Nov 5, 2019 -
HighALSA-2019:2593 1 CVE
Important: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527) For more details about the security issue(s), includ…
first Sep 2, 2019 -
High max 8.8ALSA-2019:1972 1 CVE
Important: ruby:2.5 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324…
first Jul 30, 2019 -
LowALSA-2020:1581 6 CVEs
Low: wavpack security update
WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. Security Fix(es): * wawpack: Infinite loop in WavpackPackInit function lead to DoS (CVE-2018-19840) * wawpack: Out-of-bounds re…
first Apr 28, 2020 -
High max 9.8ALSA-2020:0633 1 CVE
Important: ppp security update
The ppp packages contain the Point-to-Point Protocol (PPP) daemon and documentation for PPP support. The PPP protocol provides a method for transmitting datagrams over serial point-to-point links. PPP is usually used to dial in to an Internet Service Provider…
first Feb 27, 2020 -
High max 7.5ALSA-2019:4273 2 CVEs
Important: container-tools:1.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512) * HTTP/2: flood using HEADERS frames resul…
first Dec 17, 2019 -
Critical max 8.7
Critical: php:7.3 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043) For more details about the security issue(s), including the impact, a CVSS score, acknowle…
first Nov 6, 2019 -
High max 5.9ALSA-2019:2720 1 CVE
Important: pki-deps:10.6 security update
The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fix(es): * jackson-databind: failure to block the logback-core class from polymorphic dese…
first Sep 10, 2019 -
High max 9.8ALSA-2019:1529 4 CVEs
Important: pki-deps:10.6 security update
The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fix(es): * tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can …
first Jun 18, 2019 -
High max 9.8ALSA-2019:0981 3 CVEs
Important: python27:2.7 security update
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level int…
first May 7, 2019