4,991 results · Feed
-
High max 7.6RLSA-2025:7892 1 CVE
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123) For more details abo…
first Oct 3, 2025 -
High max 7.5RLSA-2025:8817 1 CVE
Important: .NET 9.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Oct 4, 2025 -
Medium max 9.1RLSA-2025:8682 1 CVE
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the sec…
first Oct 4, 2025 -
High max 7.7RLSA-2025:1613 3 CVEs
Important: nodejs:22 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150) * nodejs: Node.js Worker Thread Exposu…
first Feb 26, 2025 -
Medium max 6.8RLSA-2025:1446 2 CVEs
Moderate: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150) * nodejs: GOAWAY HTTP/2 frames cause m…
first Feb 13, 2025 -
High max 8.1RLSA-2025:1743 1 CVE
Important: postgresql:16 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security …
first Feb 26, 2025 -
Medium max 4.8RLSA-2025:0422 1 CVE
Moderate: java-17-openjdk security update for Rocky Linux 8.6, 8.8, 8.10, 9.4 and 9.5
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) Bug Fix(es): * The Rocky Enterprise Software Foundation OpenJDK pac…
first May 7, 2025 -
High max 8.1RLSA-2025:1742 1 CVE
Important: postgresql security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security …
first Mar 17, 2025 -
High max 8.1RLSA-2025:1741 1 CVE
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security …
first Feb 26, 2025 -
High max 8.1RLSA-2025:1738 1 CVE
Important: libpq security update
The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-…
first Mar 17, 2025 -
High max 7.2RLSA-2025:2868 1 CVE
Important: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and p…
first May 7, 2025 -
Medium max 7.0RLSA-2024:9184 1 CVE
Moderate: gtk3 security update
The GTK+ library provides a multi-platform toolkit for creating graphical user interfaces. The gtk3 packages contain GTK+ version 3. Security Fix(es): * gtk3: gtk2: Library injection from CWD (CVE-2024-6655) For more details about the security issue(s), inclu…
first Mar 17, 2025 -
High max 9.3RLSA-2025:0312 1 CVE
Important: raptor2 security update
Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor: integer underflow when normalizing a URI with the turtle parser (CVE-2024-57823) For more det…
first Mar 17, 2025 -
Medium max 5.9RLSA-2024:9827 1 CVE
Moderate: libvpx security update
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197) For more deta…
first Mar 17, 2025 -
Medium max 9.8RLSA-2025:11456 2 CVEs
Moderate: kernel-rt security update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154) * kern…
first Jul 29, 2025 -
High max 10.0RLSA-2024:9449 1 CVE
Important: bubblewrap and flatpak security update
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-…
first Nov 19, 2024 -
Medium max 9.8RLSA-2025:0917 1 CVE
Moderate: keepalived security update
The keepalived utility provides simple and robust facilities for load balancing and high availability. The load balancing framework relies on the well-known and widely used IP Virtual Server (IPVS) kernel module providing layer-4 (transport layer) load balanc…
first Mar 17, 2025 -
Medium max 5.9RLSA-2024:6785 4 CVEs
Moderate: ruby:3.3 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: DoS vulnerability in REXML (CVE-2024-39908) * rexml: rubygem-rexml: DoS when pars…
first Sep 30, 2024 -
Low max 9.1RLSA-2024:9424 2 CVEs
Low: tpm2-tools security update
The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space. Security Fix(es): * tpm2-tools: arbitrary quote data may go undetected by tpm2_checkquote (CVE-2024-29038) * tpm2-tools…
first Mar 17, 2025 -
Medium max 6.3RLSA-2024:9193 1 CVE
Moderate: python3.12-PyMySQL security update
This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython. Security Fix(es): * python-pymysql: SQL injection if used with untrusted JSON input (CVE…
first Mar 17, 2025 -
Medium max 6.5RLSA-2024:9439 2 CVEs
Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: command inject…
first Mar 17, 2025 -
Medium max 5.9RLSA-2024:9404 1 CVE
Moderate: libgcrypt security update
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix(es): * libgcrypt: vulnerable to Marvin Attack (CVE-2024-2236) For more details about the security issue(s), including the impact, a CVSS score, ac…
first Mar 17, 2025 -
High max 7.4RLSA-2025:1330 1 CVE
Important: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: RFC7250 handshakes with unauthenticated servers don…
first Mar 17, 2025 -
High max 10.0RLSA-2024:1436 1 CVE
Important: postgresql-jdbc security update
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * PostgreSQL JDBC Driver allows attacker to inject SQL if u…
first May 10, 2024 -
High max 9.1RLSA-2025:1671 49 CVEs
Important: mysql security update
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535) * krb5: GSS message token han…
first Mar 17, 2025 -
High max 7.4RLSA-2025:0210 1 CVE
Important: dpdk security update
The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fix(es): * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-…
first Mar 17, 2025 -
High max 7.8RLSA-2025:3027 1 CVE
Important: kernel-rt security update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922) For more details about the securit…
first Jul 29, 2025 -
Medium max 5.3RLSA-2024:9281 1 CVE
Moderate: python-jwcrypto security update
The python-jwcrypto package provides Python implementations of the JSON Web Key (JWK), JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT) JOSE (JSON Object Signing and Encryption) standards. Security Fix(es): * JWCrypto: denail of s…
first Mar 17, 2025 -
MediumRLSA-2024:9243 1 CVE
Moderate: postfix security update
The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS. Security Fix(es): * postfix: SMTP smuggling vulnerability (CVE-2023-51764) For more details about the security issue(s), including the im…
first Mar 17, 2025 -
Medium max 7.5RLSA-2024:9181 2 CVEs
Moderate: jose security update
Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in Rocky Linux. Security Fix(es): * jose: …
first Mar 17, 2025 -
Medium max 7.0RLSA-2024:9423 1 CVE
Moderate: python-dns security update
The python-dns package contains the dnslib module that implements a DNS client and additional modules that define certain symbolic constants used by DNS, such as dnstype, dnsclass and dnsopcode. Security Fix(es): * dnspython: denial of service in stub resolve…
first Mar 17, 2025 -
High max 7.5RLSA-2024:1503 3 CVEs
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892) * nodejs: re…
first Mar 27, 2024 -
Medium max 8.8RLSA-2025:9581 5 CVEs
Moderate: kernel-rt security update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: cifs: fix double free race when mount fails in cifs_get_root() (CVE-2022-48919) * kernel…
first Jul 29, 2025 -
Medium max 4.9RLSA-2025:0914 2 CVEs
Moderate: galera and mariadb security update
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the …
first Mar 17, 2025 -
Medium max 6.9
Moderate: gcc security update
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) …
first Mar 17, 2025 -
Medium max 6.9
Moderate: doxygen security update
Doxygen can generate an online class browser (in HTML) and/or a reference manual (in LaTeX) from a set of documented source files. The documentation is extracted directly from the sources. Doxygen can also be configured to extract the code structure from undo…
first Mar 17, 2025 -
Medium max 9.8RLSA-2025:0925 1 CVE
Moderate: bzip2 security update
The bzip2 packages contain a freely available, high-quality data compressor. It provides both standalone compression and decompression utilities, as well as a shared library for use with other programs. Security Fix(es): * bzip2: bzip2: Data integrity error w…
first Mar 17, 2025 -
Medium max 7.8RLSA-2024:5598 1 CVE
Moderate: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and p…
first May 7, 2025 -
High max 6.6RLSA-2024:10860 1 CVE
Important: ruby:3.1 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security is…
first Dec 19, 2024 -
High max 8.8RLSA-2024:5929 2 CVEs
Important: postgresql:16 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317) * postgresql: PostgreSQL relation replacement during pg_dum…
first Sep 17, 2024