2,966 results · Clear filters · Feed
-
High max 9.8RLSA-2025:10074 4 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430) * firefox: Use-af…
-
High max 7.8RLSA-2025:9305 5 CVEs
Important: xorg-x11-server and xorg-x11-server-Xwayland security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds …
-
High max 6.5RLSA-2025:8046 2 CVEs
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-31205) * webkitgtk: Processing maliciously crafted web content may lead to an …
-
High max 8.3RLSA-2025:7433 2 CVEs
Important: nodejs:22 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498) * SQLite: integer overflow in SQL…
-
High max 6.4RLSA-2025:7435 3 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523) * thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830) * thunderbi…
-
High max 7.5RLSA-2025:3411 1 CVE
Important: opentelemetry-collector security update
Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fix(es): * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) For more details about the security …
-
High max 8.1
Important: freetype security update
FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently. Security Fix(es): * freetype: OOB write when attempting to parse font subglyph structures related to …
-
High max 5.4RLSA-2025:3388 1 CVE
Important: python-jinja2 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
-
High max 9.2RLSA-2025:7418 6 CVEs
Important: php:8.3 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217) * php: Stream HTTP wrapper header check might omit basic auth he…
-
High max 7.8RLSA-2025:7417 4 CVEs
Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-lev…
-
High max 9.4RLSA-2025:10026 5 CVEs
Important: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
-
High max 10.0
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: out-of-bounds write vulnerability (CVE-2025-24201) For more details about the security issue(s), including the impact, a CVSS score, acknowle…
-
High max 7.0RLSA-2025:2670 1 CVE
Important: .NET 8.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
-
High max 7.0RLSA-2025:2667 1 CVE
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
-
High max 7.8RLSA-2025:2502 8 CVEs
Important: tigervnc security update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
-
High max 7.8RLSA-2025:2500 8 CVEs
Important: tigervnc security update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
-
High max 7.5RLSA-2025:2900 2 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1938) * firefox: thunderbird: Memory safety b…
-
High max 7.5RLSA-2025:2872 1 CVE
Important: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804) For more details about the security issue(s), includi…
-
High max 8.8RLSA-2025:1915 1 CVE
Important: emacs security update
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Shell Injection Vulnerability in GNU Emacs via…
-
High max 8.1RLSA-2025:1740 1 CVE
Important: postgresql:16 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security …
-
High max 8.1RLSA-2025:1739 1 CVE
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security …
-
High max 7.8RLSA-2024:8353 1 CVE
Important: NetworkManager-libreswan security update
This package contains software for integrating the libreswan VPN software with NetworkManager and the GNOME desktop Security Fix(es): * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050) For more details about the security iss…
-
High max 8.8RLSA-2024:6018 1 CVE
Important: postgresql:13 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) For more details about the security issue(s), including the im…
-
High max 9.8RLSA-2024:5402 10 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * Thunderbird: 115.14/128.1 () * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518) * mozilla: Out of bounds memory access in graphics sh…
-
High max 9.8RLSA-2024:5391 11 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * Firefox: 115.14/128.1 ESR () * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518) * mo…
-
High max 7.5RLSA-2024:4517 3 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 (CVE-2024-6604) * Mozilla: Race co…
-
High max 7.8RLSA-2024:4420 1 CVE
Important: virt:rhel and virt-devel:rhel security update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
-
High max 10.0RLSA-2024:6356 1 CVE
Important: bubblewrap and flatpak security update
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-…
-
High max 8.8RLSA-2024:6001 2 CVEs
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs l…
-
High max 9.1
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Encoding problem in mod_proxy (CVE-2024-38473) * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) * httpd: Improp…
-
High max 7.5RLSA-2024:5390 3 CVEs
Important: bind9.16 security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
-
High max 7.4RLSA-2024:4568 5 CVEs
Important: java-17-openjdk security update
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size ov…
-
High max 7.4RLSA-2024:4567 6 CVEs
Important: java-11-openjdk security update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size ov…
-
High max 7.4RLSA-2024:4563 6 CVEs
Important: java-1.8.0-openjdk security update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size o…
-
High max 8.6RLSA-2025:0923 1 CVE
Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working conta…
-
High max 7.5RLSA-2024:4367 1 CVE
Important: pki-core security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727) For more details about the sec…
-
High max 8.3RLSA-2024:3017 8 CVEs
Important: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Adverti…
-
High max 7.5RLSA-2024:5524 2 CVEs
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
-
High max 8.6RLSA-2024:1375 3 CVEs
Important: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: denial of service in HTTP header parser (CVE-2024-25617) * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-…
-
High max 8.6RLSA-2024:0748 3 CVEs
Important: container-tools:4.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: file descriptor leak ("Leaky Vessels") (CVE-2024-21626) A Rocky Enterprise Software Foundation Security Bulletin which …