6,419 results · Feed
-
High max 8.2ALSA-2024:2853 5 CVEs
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629) * nghttp2: CONTINUATION frames DoS (CVE…
first May 15, 2024 -
High max 8.2ALSA-2024:2779 5 CVEs
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: CONTINUATION frames DoS (CVE-2024-27983) * nodejs: using the fetch() function to retrieve conten…
first May 9, 2024 -
High max 7.8ALSA-2024:2616 3 CVEs
Important: tigervnc security update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
first Apr 30, 2024 -
High max 8.8ALSA-2024:2566 1 CVE
Important: pcp security, bug fix, and enhancement update
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of c…
first Apr 30, 2024 -
Medium max 6.5ALSA-2024:3827 3 CVEs
Moderate: buildah security and bug fix update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
first Jun 11, 2024 -
Medium max 6.5ALSA-2024:3826 3 CVEs
Moderate: podman security and bug fix update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: * podman: jose-go: improper handling of highly comp…
first Jun 11, 2024 -
Medium max 5.4ALSA-2024:3820 1 CVE
Moderate: fence-agents security update
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * jinja2: accepts keys containi…
first Jun 11, 2024 -
Medium max 9.8ALSA-2024:3671 3 CVEs
Moderate: ruby:3.3 security, bug fix, and enhancement update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.3). (AlmaLinux-37697) Securit…
first Jun 6, 2024 -
High max 8.6ALSA-2024:3513 1 CVE
Important: less security update
The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security …
first May 30, 2024 -
Medium max 5.3ALSA-2024:3501 1 CVE
Moderate: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) For more details about the security issue(s), including the impact, a CVSS score, ackn…
first May 30, 2024 -
High max 7.5ALSA-2024:3307 2 CVEs
Important: tomcat security and bug fix update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) * Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)…
first May 23, 2024 -
High max 8.8ALSA-2024:2888 6 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.11.0. Security Fix(es): * firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) * firefox: IndexedDB files retained in private browsing …
first May 16, 2024 -
High max 6.3ALSA-2024:2842 2 CVEs
Important: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first May 14, 2024 -
High max 7.5ALSA-2024:2724 4 CVEs
Important: git-lfs security update
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang: net/http, x/net/http2: unlimited number of C…
first May 7, 2024 -
Medium max 7.5ALSA-2024:2679 1 CVE
Moderate: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: use-after-free in XMLReader (CVE-2024-25062) For more details about the security issue(s), including the impact, a CVSS score, ack…
first May 2, 2024 -
Medium max 5.3ALSA-2024:2570 2 CVEs
Moderate: gnutls security update
The gnutls package provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: vulnerable to Minerva side-channel information leak (CVE-2024-28834) …
first Apr 30, 2024 -
High max 7.5ALSA-2024:2569 1 CVE
Important: grafana-pcp security update
grafana-pcp is an open source Grafana plugin for PCP. Security Fix(es): * grafana-pcp: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) For more details about the security issue(s), including the impact, a CVSS …
first Apr 30, 2024 -
Medium max 7.5ALSA-2024:2568 2 CVEs
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * grafana: vulnerable t…
first Apr 30, 2024 -
Medium max 6.5ALSA-2024:3830 1 CVE
Moderate: gvisor-tap-vsock security and bug fix update
A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor and is used to provide networking for podman-machine virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic po…
first Jun 11, 2024 -
Medium max 7.1ALSA-2024:2571 1 CVE
Moderate: sssd security and bug fix update
The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward …
first Apr 30, 2024 -
Medium max 6.5ALSA-2024:2565 1 CVE
Moderate: libreswan security update
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks…
first Apr 30, 2024 -
Medium max 7.5ALSA-2024:2564 1 CVE
Moderate: mod_http2 security update
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316) For more details about the security issue(s), including the impact…
first Apr 30, 2024 -
High max 7.5ALSA-2024:2562 7 CVEs
Important: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-202…
first Apr 30, 2024 -
Medium max 6.2ALSA-2024:2560 2 CVEs
Moderate: libvirt security and bug fix update
The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fixes: * libvirt: off-by-on…
first Apr 30, 2024 -
Medium max 7.5ALSA-2024:2550 1 CVE
Moderate: buildah bug fix update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
first Apr 30, 2024 -
Medium max 8.8ALSA-2024:2525 1 CVE
Moderate: mingw-pixman security update
Pixman is a pixel manipulation library for the X Window System and Cairo. Security Fix(es): * pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write (CVE-2022-44638) For more details about the security issue(s), including the im…
first Apr 30, 2024 -
Low max 4.8ALSA-2024:2504 2 CVEs
Low: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004) * libssh: Missing…
first Apr 30, 2024 -
Medium max 5.9ALSA-2024:2463 1 CVE
Moderate: systemd security update
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of …
first Apr 30, 2024 -
Medium max 7.5ALSA-2024:2456 3 CVEs
Moderate: grub2 security update
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware de…
first Apr 30, 2024 -
Low max 6.5ALSA-2024:2447 7 CVEs
Low: openssl and openssl-fips-provider security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: AES-SIV cipher implementation contains a bug that c…
first Apr 30, 2024 -
Medium max 6.8ALSA-2024:2559 1 CVE
Moderate: python-jwcrypto security update
The python-jwcrypto package provides Python implementations of the JSON Web Key (JWK), JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT) JOSE (JSON Object Signing and Encryption) standards. Security Fix(es): * python-jwcrypto: mali…
first Apr 30, 2024 -
High max 7.5ALSA-2024:2551 6 CVEs
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Apr 30, 2024 -
Medium max 8.6ALSA-2024:2548 2 CVEs
Moderate: podman security and bug fix update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: * podman: golang-protobuf: encoding/protojson, inte…
first Apr 30, 2024 -
Low max 5.5ALSA-2024:2528 4 CVEs
Low: mingw-glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Securi…
first Apr 30, 2024 -
Medium max 6.5ALSA-2024:2517 1 CVE
Moderate: wpa_supplicant security update
The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i / RSN), and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEE…
first Apr 30, 2024 -
LowALSA-2024:2512 1 CVE
Low: file security update
The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graph…
first Apr 30, 2024 -
Medium max 5.5ALSA-2024:2483 1 CVE
Moderate: traceroute security update
The traceroute utility displays the route used by IP packets on their way to a specified network (or Internet) host. Security Fix(es): * traceroute: improper command line parsing (CVE-2023-46316) For more details about the security issue(s), including the imp…
first Apr 30, 2024 -
Medium max 5.5ALSA-2024:2438 1 CVE
Moderate: pam security update
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * pam: allowing unprivileged user to block another user namespace (CVE-2024-22365) For…
first Apr 30, 2024 -
Medium max 6.5ALSA-2024:2208 12 CVEs
Moderate: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: Incorrect offset ca…
first Apr 30, 2024 -
Medium max 5.3ALSA-2024:2204 2 CVEs
Moderate: libnbd security update
Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: Malicious NBD server may crash libnbd (CVE-20…
first Apr 30, 2024