175 results · Clear filters · Feed
-
High max 7.8
Important: kernel-rt security update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2…
first Feb 26, 2025 -
High max 9.1
Important: httpd security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Improper escaping of output in mod_rewrite (CVE-2024-38475) * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) * …
first Jul 26, 2024 -
High max 9.8
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.3.1. Security Fix(es): * firefox: use-after-free in workers (CVE-2023-3600) * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169) * Mozilla: Use…
first Oct 5, 2023 -
Medium max 6.9
Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * jquery: Passing HTML containing <…
first May 18, 2021 -
Critical max 9.8
Critical: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.7.0 ESR. Security Fix(es): * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485) * Moz…
first Mar 10, 2022 -
Low max 8.8
Low: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of Rocky Linux. Security Fix(es): * evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459) * gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd …
first Nov 5, 2019 -
Medium max 6.9
Moderate: gcc security update
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) …
first Feb 13, 2025 -
High max 7.8
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888) Security Fix(es): * kernel: improper initialization of the "flags" membe…
first Mar 10, 2022 -
High max 7.9
Important: kernel-rt security and bug fix update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * ALSA: pcm: Move rwsem lock i…
first Apr 6, 2023 -
High max 7.9
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE…
first May 5, 2023 -
Medium max 6.9
Moderate: tbb security update
Threading Building Blocks (TBB) is a C++ runtime library that abstracts the low-level threading details necessary for optimal multi-core performance. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation meth…
first Mar 17, 2025 -
High max 7.5
Important: dotnet6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0…
first Oct 24, 2023 -
High max 9.8
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.3.1. Security Fix(es): * firefox: use-after-free in workers (CVE-2023-3600) * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169) * Mozilla: Use…
first Oct 5, 2023 -
High max 9.8
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Snapshot authentication bypass (CVE-2021-39226) For more details about the security issue(s), including the impact, a CV…
first Oct 12, 2021 -
High max 7.5
Important: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about…
first Nov 11, 2023 -
Medium max 6.9
Moderate: gcc-toolset-13-gcc security update
The gcc-toolset-13-gcc package contains the GNU Compiler Collection version 13. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), inc…
first Feb 13, 2025 -
High max 8.8
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-32435) * webkitgtk: type confusion issue leading to arbitrary code exec…
first Aug 8, 2023 -
Medium max 7.5
Moderate: nginx:1.22 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE…
first Nov 11, 2023 -
Medium max 7.5
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-39325) * HTTP/2: Multiple HTTP/2 e…
first Oct 24, 2023 -
High max 8.8
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: a use-after-free when processing maliciously crafted web content (CVE-2023-32373) * webkitgtk: an out-of-bounds read when processing maliciou…
first Jun 13, 2023 -
High max 8.8
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * WebKitGTK: use-after-free leads to arbitrary code execution (CVE-2023-28205) For more details about the security issue(s), including the impact, a CVSS …
first Apr 26, 2023 -
High max 9.8
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680) For more details about the security issue…
first Oct 25, 2024 -
Medium max 8.8
Moderate: webkit2gtk3 security and bug fix update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30858) For more details about the security issue(s), including the impact, a CVS…
first Nov 2, 2021 -
Medium max 6.9
Moderate: gcc-toolset-13-gcc security update
The gcc-toolset-13-gcc13 package contains the GNU Compiler Collection version 13. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), i…
first Mar 17, 2025 -
Medium max 6.9
Moderate: tbb security update
Threading Building Blocks (TBB) is a C++ runtime library that abstracts the low-level threading details necessary for optimal multi-core performance. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation meth…
first Feb 13, 2025 -
Low max 3.9
Low: open-vm-tools security update
The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: auth…
first Jul 8, 2023 -
High max 7.8
Important: .NET 6.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Oct 6, 2023 -
High max 7.8
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096) * kernel: Out of boundary write in perf_read_group() as result of ov…
first Apr 5, 2024 -
High max 8.8
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * WebKitGTK: use-after-free leads to arbitrary code execution (CVE-2023-28205) For more details about the security issue(s), including the impact, a CVSS …
first Apr 26, 2023 -
High max 7.5
Important: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about…
first Oct 24, 2023 -
High max 9.6
Important: freetype security update
FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently. Security Fix(es): * freetype: Heap-based buffer overflow due to integer truncation in Load_SBit_Png (…
first Nov 5, 2020 -
High max 9.0
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:" (CVE-2021-40438) * httpd: mod_session: Heap overflow via a crafte…
first Oct 12, 2021 -
Medium max 8.6
Moderate: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516) * race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NU…
first Nov 8, 2022 -
Medium max 8.8
Moderate: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of Rocky Linux. The following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-port…
first Nov 3, 2020 -
Medium max 6.9
Moderate: gcc-toolset-14-gcc security update
The gcc-toolset-14-gcc package contains the GNU Compiler Collection version 14. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), inc…
first Feb 13, 2025 -
Medium max 7.8
Moderate: php:7.4 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked (CVE-2020-28948) * Archive_Tar: improper filename sanitiz…
first Sep 15, 2022 -
High max 10.0
Important: kernel security update
Errata Tool Automation could not update the description because it is longer (4803) than ET limit of 4000 characters. (OSCI-6058) Please update the description manually.
first Aug 21, 2024 -
High max 7.5
Important: nodejs security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)…
first Oct 24, 2023 -
Low max 3.9
Low: open-vm-tools security update
The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: auth…
first Jul 8, 2023 -
High max 7.9
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * …
first Apr 6, 2023