6,419 results · Feed
-
Low max 9.1ALSA-2024:9424 2 CVEs
Low: tpm2-tools security update
The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space. Security Fix(es): * tpm2-tools: arbitrary quote data may go undetected by tpm2_checkquote (CVE-2024-29038) * tpm2-tools…
first Nov 12, 2024 -
Medium max 5.4ALSA-2024:9150 1 CVE
Moderate: python-jinja2 security update
The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Security Fix(es): * jinja2: accepts keys containing no…
first Nov 12, 2024 -
Medium max 8.2ALSA-2024:9136 3 CVEs
Moderate: qemu-kvm security update
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * QEMU: SR-IOV: improper validati…
first Nov 12, 2024 -
Medium max 6.2ALSA-2024:9128 1 CVE
Moderate: libvirt security update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs f…
first Nov 12, 2024 -
Medium max 7.8ALSA-2024:9122 3 CVEs
Moderate: xorg-x11-server security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSele…
first Nov 12, 2024 -
Medium max 7.8ALSA-2024:8617 22 CVEs
Moderate: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201) * kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640) * kernel: mptcp: f…
first Oct 30, 2024 -
Medium max 7.5ALSA-2024:9180 1 CVE
Moderate: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: DoS when using `OIDC…
first Nov 12, 2024 -
Medium max 7.5ALSA-2024:9167 1 CVE
Moderate: poppler security update
Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: pdfinfo: crash in broken documents when using -dests parameter (CVE-2024-6239) For more details about the security issue(s), inclu…
first Nov 12, 2024 -
Medium max 7.5ALSA-2024:9158 3 CVEs
Moderate: lldpd security update
LLDP is an industry standard protocol designed to supplant proprietary Link-Layer protocols such as EDP or CDP. The goal of LLDP is to provide an inter-vendor compatible mechanism to deliver Link-Layer notifications to adjacent network devices. Security Fix(e…
first Nov 12, 2024 -
High max 8.8ALSA-2024:9144 4 CVEs
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkit: visiting a malicious website may lead to address bar spoofing (CVE-2023-42843) * webkit: heap use-after-free may lead to arbitrary code executio…
first Nov 12, 2024 -
Medium max 7.5ALSA-2024:9135 4 CVEs
Moderate: toolbox security update
Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fix(es): * golang: net/[http:](http:) golang: mime/multip…
first Nov 12, 2024 -
Medium max 9.8ALSA-2024:9115 5 CVEs
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788) * golang: archive/zip: Incorrect handling of certain …
first Nov 12, 2024 -
Medium max 7.8ALSA-2024:9093 3 CVEs
Moderate: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CV…
first Nov 12, 2024 -
Medium max 7.5ALSA-2024:9089 2 CVEs
Moderate: containernetworking-plugins security update
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity …
first Nov 12, 2024 -
Medium max 6.5ALSA-2024:9088 4 CVEs
Moderate: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC…
first Nov 12, 2024 -
Medium max 7.5ALSA-2024:8935 1 CVE
Moderate: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For mor…
first Nov 6, 2024 -
Medium max 7.5ALSA-2024:8914 1 CVE
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006) For more details about the security issue(s), including the impa…
first Nov 5, 2024 -
Medium max 9.8ALSA-2024:8726 10 CVEs
Moderate: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10…
first Oct 31, 2024 -
Low max 5.4ALSA-2024:8680 1 CVE
Low: mod_http2 security update
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * mod_http2: DoS by null pointer in websocket over HTTP/2 (CVE-2024-36387) For more details about the security issue(s), includ…
first Oct 30, 2024 -
Medium max 7.5ALSA-2024:8447 1 CVE
Moderate: python3.12 security update
Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package …
first Oct 24, 2024 -
High max 9.8ALSA-2024:8180 11 CVEs
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution (CVE-2024-40776) * webkitgtk: webkit2gtk: Processing maliciously crafted web con…
first Oct 16, 2024 -
Medium max 6.5ALSA-2024:9114 1 CVE
Moderate: gnome-shell and gnome-shell-extensions security update
GNOME Shell acts as a compositing manager for the desktop, and displays both application windows and other objects. It provides core interface functions like switching windows, launching applications, and notifications. It takes advantage of the capabilities …
first Nov 12, 2024 -
Medium max 8.3ALSA-2024:9098 4 CVEs
Moderate: skopeo security update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * containers/image: digest type does not guarantee valid type (CVE-2024-3727) * golang: n…
first Nov 12, 2024 -
Medium max 8.3ALSA-2024:9097 2 CVEs
Moderate: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
first Nov 12, 2024 -
High max 7.8ALSA-2024:9051 3 CVEs
Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * Buildah: Podman: Improper Input Validation in b…
first Nov 11, 2024 -
High max 9.1ALSA-2024:8800 1 CVE
Important: openexr security update
OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the …
first Nov 4, 2024 -
Medium max 9.8ALSA-2024:8793 10 CVEs
Moderate: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464) * firefox: thunderbird: XSS due to Content-D…
first Nov 4, 2024 -
High max 10.0ALSA-2024:8678 2 CVEs
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875) For…
first Oct 30, 2024 -
High max 7.8ALSA-2024:8563 1 CVE
Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
first Oct 29, 2024 -
Medium max 7.5ALSA-2024:8374 1 CVE
Moderate: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Oct 23, 2024 -
High max 9.8ALSA-2024:5928 41 CVEs
Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nftables: nft_set_rbtree skip end interval element from gc (CVE-2024-26581) * kernel: netfilter: nft_limit: reject configurations that cause inte…
first Aug 28, 2024 -
Medium max 7.8ALSA-2024:5583 1 CVE
Moderate: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and p…
first Aug 19, 2024 -
High max 9.8ALSA-2024:5322 11 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * Firefox: 115.14/128.1 ESR () * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518) * mo…
first Aug 15, 2024 -
Medium max 5.5ALSA-2024:6146 1 CVE
Moderate: python3.12 security update
Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package …
first Sep 3, 2024 -
High max 8.8ALSA-2024:5999 1 CVE
Important: postgresql security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) For more details about the security issue(s), including the im…
first Aug 29, 2024 -
Medium max 6.5ALSA-2024:5815 3 CVEs
Moderate: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Bypass network import restriction via data URL (CVE-2024-22020) * nodejs: fs.lstat bypasses perm…
first Aug 26, 2024 -
High max 8.8ALSA-2024:5534 1 CVE
Important: python-setuptools security update
The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing convenient building and distribution of Python packages. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the pac…
first Aug 19, 2024 -
High max 8.8ALSA-2024:5533 1 CVE
Important: python3.12-setuptools security update
Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptool…
first Aug 19, 2024 -
High max 9.8ALSA-2024:5392 10 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * EMBARGOED Thunderbird: 115.14/128.1 () * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518) * mozilla: Out of bounds memory access in g…
first Aug 14, 2024 -
Medium max 6.5ALSA-2024:5334 1 CVE
Moderate: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Aug 15, 2024