6,419 results · Feed
-
Medium max 5.9ALSA-2024:2337 1 CVE
Moderate: python3.11-cryptography security update
The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. Security Fix(es): * python-cryptography: NULL-dereference when loading PKCS7 c…
first Apr 30, 2024 -
Medium max 7.6ALSA-2024:2303 1 CVE
Moderate: gstreamer1-plugins-good security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer-plu…
first Apr 30, 2024 -
Medium max 5.3ALSA-2024:2292 1 CVE
Moderate: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Apr 30, 2024 -
Medium max 8.8ALSA-2024:2287 4 CVEs
Moderate: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer-plugins-bad: Integer overflow leading to he…
first Apr 30, 2024 -
MediumALSA-2024:2272 2 CVEs
Moderate: containernetworking-plugins security update
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity …
first Apr 30, 2024 -
High max 8.3ALSA-2024:2264 8 CVEs
Important: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Adverti…
first Apr 30, 2024 -
Medium max 5.0ALSA-2024:2246 1 CVE
Moderate: ansible-core bug fix, enhancement, and security update
Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written…
first Apr 30, 2024 -
MediumALSA-2024:2211 1 CVE
Moderate: tcpdump security update
The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces. Security Fix(es): * tcpslice: use-after-free in extract_sli…
first Apr 30, 2024 -
High max 7.5ALSA-2024:1789 6 CVEs
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Apr 11, 2024 -
High max 10.0ALSA-2024:1436 1 CVE
Important: postgresql-jdbc security update
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * PostgreSQL JDBC Driver allows attacker to inject SQL if u…
first Mar 20, 2024 -
High max 8.3ALSA-2024:1427 2 CVEs
Important: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and p…
first Mar 19, 2024 -
High max 7.5ALSA-2024:1963 1 CVE
Important: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)
first Apr 23, 2024 -
High max 8.3ALSA-2024:1903 6 CVEs
Important: shim bug fix update
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments. Security Fix(es): * shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547) * shim: Interger ov…
first Apr 18, 2024 -
High max 8.0ALSA-2024:1750 1 CVE
Important: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runti…
first Apr 10, 2024 -
Medium max 7.8ALSA-2024:1692 1 CVE
Moderate: less security update
The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security …
first Apr 8, 2024 -
High max 7.9ALSA-2024:1688 7 CVEs
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (…
first Apr 8, 2024 -
Medium max 8.8ALSA-2024:1576 4 CVEs
Moderate: ruby:3.1 security, bug fix, and enhancement update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.1). (AlmaLinux-29052) Securit…
first Apr 1, 2024 -
High max 7.5ALSA-2024:1502 1 CVE
Important: grafana-pcp security update
grafana-pcp is an open source Grafana plugin for PCP. Security Fix(es): * grafana-pcp: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
first Mar 25, 2024 -
High max 7.5ALSA-2024:1501 1 CVE
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
first Mar 25, 2024 -
Medium max 5.9ALSA-2024:1239 1 CVE
Moderate: opencryptoki security update
The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM …
first Mar 7, 2024 -
Low max 2.3ALSA-2024:1139 1 CVE
Low: keylime security update
Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Attestation failure when the quote's signature does not validate (CVE-2023-3674) For more details about the security issue(…
first Mar 5, 2024 -
Medium max 4.7ALSA-2024:11250 1 CVE
Moderate: pam security update
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041) For more det…
first Dec 17, 2024 -
Medium max 4.2ALSA-2024:11238 1 CVE
Moderate: python3.11-urllib3 security update
The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fix(es): * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) For more details a…
first Dec 17, 2024 -
Medium max 6.5ALSA-2024:2033 1 CVE
Moderate: libreswan security and bug fix update
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks…
first Apr 24, 2024 -
Medium max 5.3ALSA-2024:1879 2 CVEs
Moderate: gnutls security update
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: vulnerable to Minerva side-channel information leak (CVE-2024-28834)…
first Apr 18, 2024 -
High max 7.5ALSA-2024:1691 1 CVE
Important: varnish security update
Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/2 Broken Window Attack …
first Apr 8, 2024 -
Medium max 7.5ALSA-2024:1530 2 CVEs
Moderate: expat security update
Expat is a C library for parsing XML documents. Security Fix(es): * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425) * expat: XML Entity Expansion (CVE-2024-28757)
first Mar 26, 2024 -
Medium max 8.8ALSA-2024:1493 9 CVEs
Moderate: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.9.0. Security Fix(es): * nss: timing attack against RSA decryption (CVE-2023-5388) * Mozilla: Crash in NSS TLS method (CVE-2024-0743) * Mozilla: Lea…
first Mar 25, 2024 -
Medium max 5.9ALSA-2024:1150 1 CVE
Moderate: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
first Mar 5, 2024 -
MediumALSA-2024:1149 1 CVE
Moderate: skopeo security update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP re…
first Mar 5, 2024 -
Medium max 9.8ALSA-2024:11486 17 CVEs
Moderate: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement i…
first Dec 19, 2024 -
Medium max 5.5ALSA-2024:1147 1 CVE
Moderate: rear security update
Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and restores from backup using this image. It allows to restore to different hardware and can therefore be also used as a migration utility. Security Fix(es): …
first Mar 5, 2024 -
Medium max 6.5ALSA-2024:1130 2 CVEs
Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * ssh: Prefix truncation attack on Binary Packet Prot…
first Mar 5, 2024 -
High max 8.8ALSA-2026:90523 1 CVE
Important: xdg-dbus-proxy security update
xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es): * xdg-dbus-proxy: xdg-dbus-proxy: message f…
first Oct 27, 2026 -
Medium max 9.8ALSA-2026:89905 6 CVEs
Moderate: freeipmi security, bug fix, and enhancement update
The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Even…
first Oct 26, 2026 -
Medium max 6.1ALSA-2024:2119 1 CVE
Moderate: Image builder components bug fix, enhancement and security update
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fix(es): * osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)…
first Apr 30, 2024 -
Medium max 5.8ALSA-2024:2113 3 CVEs
Moderate: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126) * rubygem-rack: Possible DoS Vulnerability w…
first Apr 30, 2024 -
High max 7.5ALSA-2024:1438 1 CVE
Important: nodejs security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-220…
first Mar 20, 2024 -
High max 8.6ALSA-2024:1376 3 CVEs
Important: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: denial of service in HTTP header parser (CVE-2024-25617) * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-…
first Mar 19, 2024 -
Medium max 7.5ALSA-2024:1309 1 CVE
Moderate: .NET 7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Mar 13, 2024