6,419 results · Feed
-
HighALSA-2024:2199 1 CVE
Important: pmix security update
The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. Security F…
first Apr 30, 2024 -
MediumALSA-2024:2193 2 CVEs
Moderate: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang: net/http/internal: Denial of Service (D…
first Apr 30, 2024 -
MediumALSA-2024:2184 1 CVE
Moderate: libsndfile security update
libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in src/mat4.c and src/au.c leads to DoS (CVE-2022-33065) For more details about the security issue(s),…
first Apr 30, 2024 -
Medium max 9.8ALSA-2024:2170 9 CVEs
Moderate: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367) * xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (…
first Apr 30, 2024 -
Medium max 9.8ALSA-2024:2169 10 CVEs
Moderate: xorg-x11-server security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRCh…
first Apr 30, 2024 -
MediumALSA-2024:2160 3 CVEs
Moderate: toolbox security update
Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fix(es): * golang: html/template: improper handling of HT…
first Apr 30, 2024 -
Medium max 5.9ALSA-2024:2159 1 CVE
Moderate: python3.11-urllib3 security update
The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fix(es): * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804) For more details about the secu…
first Apr 30, 2024 -
Medium max 9.1ALSA-2024:2156 8 CVEs
Moderate: frr security update
FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489…
first Apr 30, 2024 -
Medium max 5.3ALSA-2024:2147 1 CVE
Moderate: ipa security update
AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: specially crafted HTTP requests potentially lead to…
first Apr 30, 2024 -
Medium max 5.5ALSA-2024:2146 2 CVEs
Moderate: libXpm security update
X.Org X11 libXpm runtime library. Security Fix(es): * libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788) * libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789) For more details about the security issue(s), inclu…
first Apr 30, 2024 -
Medium max 7.8ALSA-2024:2145 3 CVEs
Moderate: libX11 security update
The libX11 packages contain the core X11 protocol client library. Security Fix(es): * libX11: out-of-bounds memory access in _XkbReadKeySyms() (CVE-2023-43785) * libX11: stack exhaustion from infinite recursion in PutSubImage() (CVE-2023-43786) * libX11: inte…
first Apr 30, 2024 -
LowALSA-2024:2137 1 CVE
Low: LibRaw security update
LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): * LibRaw: a heap-buffer-overflow in raw2image_ex() (CVE-2023-1729) For more details about the security issue(s), including th…
first Apr 30, 2024 -
Medium max 6.5ALSA-2024:2135 5 CVEs
Moderate: qemu-kvm security update
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * QEMU: e1000e: heap use-after-fr…
first Apr 30, 2024 -
Medium max 5.9ALSA-2024:2132 3 CVEs
Moderate: fence-agents security and bug fix update
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: Request body not str…
first Apr 30, 2024 -
Medium max 7.5ALSA-2024:2180 4 CVEs
Moderate: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (…
first Apr 30, 2024 -
High max 9.8ALSA-2024:2126 10 CVEs
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2023-40414) * webkitgtk: Processing web content may lead to arbitrary code e…
first Apr 30, 2024 -
High max 7.8ALSA-2024:10090 1 CVE
Important: tigervnc security update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
first Nov 20, 2024 -
High max 8.1ALSA-2024:0952 8 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.8.0 ESR. Security Fix(es): * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546) …
first Feb 22, 2024 -
High max 8.0ALSA-2024:0951 1 CVE
Important: postgresql security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including th…
first Feb 22, 2024 -
High max 8.0ALSA-2024:0950 1 CVE
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including th…
first Feb 22, 2024 -
High max 7.8ALSA-2024:0675 4 CVEs
Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-lev…
first Feb 5, 2024 -
High max 8.8ALSA-2024:0603 9 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.7.0 ESR. Security Fix(es): * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741) * Mozilla: Failure t…
first Jan 30, 2024 -
High max 8.8ALSA-2024:0602 9 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.7.0. Security Fix(es): * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741) * Mozilla: Failure to update user input timestamp (CVE-2024-0742) * M…
first Jan 30, 2024 -
High max 9.8ALSA-2024:0557 4 CVEs
Important: tigervnc security update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
first Jan 30, 2024 -
Medium max 7.5ALSA-2024:0533 3 CVEs
Moderate: gnutls security update
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981) * …
first Jan 29, 2024 -
Medium max 7.5ALSA-2024:0477 4 CVEs
Moderate: frr security update
FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406) * ffr: Out of bounds …
first Jan 25, 2024 -
Medium max 6.1ALSA-2024:0474 4 CVEs
Moderate: tomcat security update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080) * tomcat: FileUpload: DoS due to accumulation of temporary files…
first Jan 25, 2024 -
Medium max 5.3ALSA-2024:0466 1 CVE
Moderate: python3.9 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Jan 25, 2024 -
MediumALSA-2024:0463 3 CVEs
Moderate: rpm security update
The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Security Fix(es): * rpm: TOCTOU race in checks for unsafe symlinks (CVE-2021-35937) * rp…
first Jan 25, 2024 -
Medium max 9.8ALSA-2024:10218 1 CVE
Moderate: perl-App-cpanminus security update
Why? It's dependency free, requires zero configuration, and stands alone but it's maintainable and extensible with plug-ins and friendly to shell scripting. When running, it requires only 10 MB of RAM. Security Fix(es): * perl-App-cpanminus: Insecure HTTP in …
first Nov 25, 2024 -
High max 7.5ALSA-2024:0977 2 CVEs
Important: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU reso…
first Feb 26, 2024 -
High max 8.1ALSA-2024:0963 8 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.8.0. Security Fix(es): * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546) * Mozilla: Alert dialog could have been spoofed o…
first Feb 26, 2024 -
High max 7.5ALSA-2024:0848 2 CVEs
Important: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Feb 15, 2024 -
MediumALSA-2024:0811 3 CVEs
Moderate: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Bug Fix(es) and Enhance…
first Feb 14, 2024 -
High max 7.5ALSA-2024:0807 2 CVEs
Important: dotnet6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Feb 13, 2024 -
High max 7.5ALSA-2024:0805 2 CVEs
Important: dotnet7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Feb 13, 2024 -
MediumALSA-2024:0790 1 CVE
Moderate: nss security update
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fix(es): * nss: vulnerable to Minerva side-channel information leak (CVE-2023-6135) For more …
first Feb 12, 2024 -
High max 8.6ALSA-2024:0670 1 CVE
Important: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * runc: file descriptor leak (CVE-2024-21626) For more details about the security issue(s), including the impact, a C…
first Feb 2, 2024 -
Medium max 6.8ALSA-2024:0468 1 CVE
Moderate: grub2 security update
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware de…
first Jan 25, 2024 -
Medium max 5.5ALSA-2024:0465 1 CVE
Moderate: sqlite security update
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the p…
first Jan 25, 2024