6,444 results · Feed
-
Medium max 7.8ALSA-2024:5598 1 CVE
Moderate: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and p…
first Aug 20, 2024 -
Medium max 9.8ALSA-2024:4499 6 CVEs
Moderate: ruby security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-202…
first Jul 11, 2024 -
Medium max 9.8ALSA-2025:15008 4 CVEs
Moderate: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2…
first Sep 2, 2025 -
High max 9.8ALSA-2025:14743 5 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer …
first Aug 27, 2025 -
Medium max 4.4ALSA-2024:8842 1 CVE
Moderate: python3.12-urllib3 security update
urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: • Thread safety. • Connection pooling. • Client-side SSL/TLS verification. • File uploads with multipart en…
first Nov 5, 2024 -
Medium max 7.5ALSA-2024:8838 1 CVE
Moderate: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Nov 5, 2024 -
Medium max 7.5ALSA-2024:8836 1 CVE
Moderate: python3.12 security update
Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package …
first Nov 5, 2024 -
High max 9.8ALSA-2024:8834 1 CVE
Important: python-gevent security update
gevent is a coroutine-based Python networking library that uses greenlet to provide a high-level synchronous API on top of libevent event loop. Features include: * convenient API around greenlets * familiar synchronization primitives (gevent.event, gevent.que…
first Nov 5, 2024 -
Medium max 7.5ALSA-2024:8833 1 CVE
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006) For more details about the security issue(s), including the impa…
first Nov 5, 2024 -
Medium max 7.8ALSA-2024:8798 1 CVE
Moderate: xorg-x11-server and xorg-x11-server-Xwayland security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege esc…
first Nov 4, 2024 -
Medium max 9.8ALSA-2024:8790 10 CVEs
Moderate: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464) * firefox: thunderbird: XSS due to Content-D…
first Nov 4, 2024 -
High max 10.0ALSA-2024:8327 2 CVEs
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875) For…
first Oct 22, 2024 -
High max 10.0ALSA-2024:6422 1 CVE
Important: bubblewrap and flatpak security update
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-…
first Sep 5, 2024 -
Medium max 8.8ALSA-2024:6311 2 CVEs
Moderate: resource-agents security update
The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * urllib3: proxy-authorization…
first Sep 4, 2024 -
Medium max 8.6ALSA-2024:5654 1 CVE
Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: HTTP/2 push headers memory-leak (CVE-2024-2398) For more details about the …
first Aug 20, 2024 -
High max 8.8ALSA-2024:5531 1 CVE
Important: python3.12-setuptools security update
Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptool…
first Aug 19, 2024 -
High max 7.5ALSA-2024:5524 2 CVEs
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Aug 19, 2024 -
High max 9.8ALSA-2024:5391 11 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * Firefox: 115.14/128.1 ESR () * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518) * mo…
first Aug 14, 2024 -
Medium max 9.8ALSA-2024:5291 3 CVEs
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788) * golang: archive/zip: Incorrect handling of certain …
first Aug 13, 2024 -
High max 9.1
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Encoding problem in mod_proxy (CVE-2024-38473) * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) * httpd: Improp…
first Jul 23, 2024 -
High max 8.3ALSA-2024:1902 6 CVEs
Important: shim security update
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments. Security Fix(es): * shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547) * shim: Interger ov…
first Apr 18, 2024 -
High max 7.5ALSA-2024:1786 1 CVE
Important: httpd:2.4/mod_http2 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_http2: CONTINUATION frames DoS (CVE-2024-27316) For more details about the security issue(s), including the impact, a CVSS scor…
first Apr 11, 2024 -
Medium max 5.3ALSA-2024:1784 1 CVE
Moderate: gnutls security update
The gnutls package provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. This package update fixes a timing side-channel in deterministic ECDSA. Security Fix(es): * gnutl…
first Apr 11, 2024 -
High max 7.5ALSA-2024:1782 3 CVEs
Important: bind and dhcp security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Apr 12, 2024 -
High max 7.5ALSA-2024:1781 6 CVEs
Important: bind9.16 security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Apr 11, 2024 -
High max 8.0ALSA-2024:1751 1 CVE
Important: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runti…
first Apr 11, 2024 -
Medium max 5.5ALSA-2024:1719 1 CVE
Moderate: rear security update
Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and restores from backup using this image. It allows to restore to different hardware and can therefore be also used as a migration utility. Security Fix(es): …
first Apr 9, 2024 -
High max 7.5ALSA-2024:1690 1 CVE
Important: varnish security update
Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/2 Broken Window Attack …
first Apr 8, 2024 -
High max 7.9ALSA-2024:1687 7 CVEs
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (…
first Apr 8, 2024 -
High max 7.5ALSA-2024:1646 1 CVE
Important: grafana security and bug fix update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) Bug Fix(es): * TRIAGE CVE-2024-1…
first Apr 2, 2024 -
High max 7.5ALSA-2024:1644 1 CVE
Important: grafana-pcp security and bug fix update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang-fips/openssl: Memory leaks in…
first Apr 2, 2024 -
Medium max 7.5ALSA-2024:1615 1 CVE
Moderate: expat security update
Expat is a C library for parsing XML documents. Security Fix(es): * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other relat…
first Apr 2, 2024 -
Medium max 7.8ALSA-2024:1610 1 CVE
Moderate: less security update
The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security …
first Apr 2, 2024 -
High max 8.8ALSA-2024:10830 3 CVEs
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 5, 2024 -
High max 8.8ALSA-2024:10785 3 CVEs
Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 4, 2024 -
Medium max 6.3ALSA-2024:10779 2 CVEs
Moderate: python3:3.6.8 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Dec 4, 2024 -
High max 8.8ALSA-2024:10752 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandle…
first Dec 3, 2024 -
High max 8.3ALSA-2024:1063 2 CVEs
Important: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023…
first Mar 4, 2024 -
High max 8.8ALSA-2024:10591 7 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159) * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CV…
first Dec 2, 2024 -
High max 7.4ALSA-2024:10379 2 CVEs
Important: pam security update
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041) * pam: Impro…
first Nov 26, 2024