6,419 results · Feed
-
Medium max 5.9ALSA-2024:6187 1 CVE
Moderate: gvisor-tap-vsock security update
A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor and is used to provide networking for podman-machine virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic po…
first Sep 3, 2024 -
Medium max 5.5ALSA-2024:6179 1 CVE
Moderate: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Sep 3, 2024 -
Medium max 9.1ALSA-2024:6166 2 CVEs
Moderate: krb5 security update
Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the he…
first Sep 3, 2024 -
High max 8.8ALSA-2024:1908 7 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.10.0 ESR. Security Fix(es): * GetBoundName in the JIT returned the wrong object (CVE-2024-3852) * Out-o…
first Apr 18, 2024 -
High max 7.5ALSA-2024:1872 1 CVE
Important: mod_http2 security update
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: CONTINUATION frames DoS (CVE-2024-27316) For more details about the security issue(s), including the impact, a CVSS sc…
first Apr 18, 2024 -
High max 7.5ALSA-2024:1503 3 CVEs
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892) * nodejs: re…
first Mar 25, 2024 -
High max 7.5ALSA-2024:2079 1 CVE
Important: git-lfs security update
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang: net/http, x/net/http2: unlimited number of C…
first Apr 29, 2024 -
High max 7.5ALSA-2024:1462 1 CVE
Important: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * golang: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
first Mar 21, 2024 -
High max 7.5ALSA-2024:1334 2 CVEs
Important: dnsmasq security update
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * dnsmasq:…
first Mar 14, 2024 -
Medium max 8.2ALSA-2024:1142 2 CVEs
Moderate: haproxy security update
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: Proxy forwards malformed empty Content-Length headers (CVE-2023-40225) * haproxy: untrimmed URI fragments may lea…
first Mar 5, 2024 -
High max 7.5ALSA-2024:1134 1 CVE
Important: tomcat security update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589) For more details about the security issue(s), including the im…
first Mar 5, 2024 -
Medium max 6.5ALSA-2024:1129 1 CVE
Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218) For…
first Mar 5, 2024 -
Medium max 6.7ALSA-2024:11242 1 CVE
Moderate: mpg123:1.32.9 security update
The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries. Security Fix(es): * mpg123: Buffer overflow when writing…
first Dec 17, 2024 -
Medium max 5.3ALSA-2024:11232 1 CVE
Moderate: unbound:1.16.2 security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508) For more details about the security issue(s), including the impac…
first Dec 17, 2024 -
Medium max 5.9ALSA-2024:11219 1 CVE
Moderate: edk2:20240524 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796) For more d…
first Dec 17, 2024 -
Critical max 8.8ALSA-2024:1485 10 CVEs
Critical: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.9.1 ESR. Security Fix(es): * nss: timing attack against RSA decryption (CVE-2023-5388) * Mozilla: Crash…
first Mar 25, 2024 -
MediumALSA-2024:1131 2 CVEs
Moderate: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326) * golang: cmd/go: Protocol Fallback when fetching modules (CVE…
first Mar 5, 2024 -
High max 7.5ALSA-2024:11217 1 CVE
Important: skopeo security update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested …
first Dec 17, 2024 -
High max 8.6ALSA-2024:11123 3 CVEs
Important: gstreamer1-plugins-base security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer1-plugins-base: GStreamer has a stack-buf…
first Dec 16, 2024 -
Medium max 5.3ALSA-2024:11111 1 CVE
Moderate: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Dec 16, 2024 -
Medium max 7.5ALSA-2024:10950 7 CVEs
Moderate: php:8.1 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CV…
first Dec 11, 2024 -
Medium max 7.5ALSA-2024:10949 7 CVEs
Moderate: php:8.2 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CV…
first Dec 11, 2024 -
Medium max 9.8ALSA-2024:10939 7 CVEs
Moderate: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615) * kernel: block: initialize integrity buffer to zero before writin…
first Dec 11, 2024 -
High max 8.8ALSA-2024:10788 3 CVEs
Important: postgresql:16 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
High max 8.3ALSA-2024:1075 2 CVEs
Important: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023…
first Mar 5, 2024 -
High max 7.5ALSA-2024:10590 1 CVE
Important: python-tornado security update
Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools. Security Fix(es): * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804) F…
first Dec 2, 2024 -
Medium max 6.3ALSA-2024:10983 2 CVEs
Moderate: python3.9:3.9.21 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Dec 12, 2024 -
High max 8.7ALSA-2024:10978 2 CVEs
Important: python3.12 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Dec 12, 2024 -
High max 6.6ALSA-2024:10860 1 CVE
Important: ruby:3.1 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security is…
first Dec 5, 2024 -
High max 6.6ALSA-2024:10858 1 CVE
Important: ruby security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security is…
first Dec 5, 2024 -
High max 8.8ALSA-2024:10791 3 CVEs
Important: postgresql security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
High max 8.8ALSA-2024:10787 3 CVEs
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
High max 8.8ALSA-2024:10702 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandle…
first Dec 2, 2024 -
High max 8.8ALSA-2024:10592 7 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159) * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CV…
first Dec 2, 2024 -
High max 6.3
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: data isolation bypass vulnerability (CVE-2024-44309) For more details about the security issue(s), including the impact, a CVSS score, acknow…
first Nov 27, 2024 -
High max 7.8ALSA-2024:10384 2 CVEs
Important: tuned security update
The tuned packages provide a service that tunes system settings according to a selected profile. Security Fix(es): * tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root (CVE-2024-52336) * tuned: improper sanitization…
first Nov 26, 2024 -
Medium max 9.8ALSA-2023:6659 1 CVE
Moderate: python3.9 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Nov 7, 2023 -
Medium max 5.5ALSA-2023:6621 1 CVE
Moderate: protobuf-c security update
The protobuf-c packages provide C bindings for Google's Protocol Buffers. Security Fix(es): * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468) For more details about the security issue(s), including the impact, a CVSS score, ack…
first Nov 7, 2023 -
Medium max 7.5ALSA-2023:6596 2 CVEs
Moderate: cups security and bug fix update
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: heap buffer overflow may lead to DoS (CVE-2023-32324) * cups: use-after-free in cupsdAcceptClient() in schedule…
first Nov 7, 2023 -
High max 8.2ALSA-2023:6595 6 CVEs
Important: linux-firmware security, bug fix, and enhancement update
The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fix(es): * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-27635) * hw: intel: Improper access control …
first Nov 7, 2023