4,991 results · Feed
-
High max 7.5RLSA-2024:2724 4 CVEs
Important: git-lfs security update
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang: net/http, x/net/http2: unlimited number of C…
first May 10, 2024 -
High max 8.8
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Arbitrary Remote Code Execution (CVE-2023-42917) For more details about the security issue(s), including the impact, a CVSS score, acknowledg…
first Jan 9, 2024 -
Medium max 7.4RLSA-2023:1141 1 CVE
Moderate: gnutls security and bug fix update
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: timing side-channel in the TLS RSA key exchange code (CVE-2023-0361)…
first Mar 8, 2023 -
HighRLSA-2021:0735 2 CVEs
Important: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (10.24.0). Security Fix(es): * nodejs: HTTP2 '…
first Mar 4, 2021 -
High max 7.5RLSA-2024:6946 1 CVE
Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * encoding/gob: golang: Calling Decode…
first Sep 30, 2024 -
Medium max 6.5RLSA-2024:2962 4 CVEs
Moderate: virt:rhel and virt-devel:rhel security and enhancement update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide API…
first Jun 14, 2024 -
High max 8.8RLSA-2023:7581 4 CVEs
Important: postgresql:13 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) * postgresql: Memory disclosure in aggregate function calls (CVE-2023-586…
first Dec 6, 2023 -
High max 9.8RLSA-2023:4419 1 CVE
Important: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Remote code execution in ssh-agent PKCS#11…
first Aug 8, 2023 -
Medium max 5.9RLSA-2023:3106 1 CVE
Moderate: curl security and bug fix update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: FTP too eager connection reuse (CVE-2023-27535) For more details about the …
first May 18, 2023 -
High max 9.8RLSA-2023:2652 3 CVEs
Important: pcs security and bug fix update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: webpack: Regression of CVE-2023-28154 fixes in the Rocky Linux (CVE-2023-2319) * rubygem-rack: Denial of service in Multipart MIME …
first May 25, 2023 -
MediumRLSA-2023:0446 3 CVEs
Moderate: go-toolset:rhel8 security and bug fix update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879) * golang: net/http/httputil: ReverseProxy shou…
first Jan 25, 2023 -
Medium max 9.1RLSA-2022:7647 10 CVEs
Moderate: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943) * httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719) …
first Nov 8, 2022 -
Medium max 9.8RLSA-2022:5498 28 CVEs
Moderate: Satellite 6.11 Release
Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fix(es): * libsolv…
first Jul 5, 2022 -
Medium max 7.4RLSA-2021:5226 1 CVE
Moderate: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Read buffer overruns processing ASN.1 strings (CVE-…
first Dec 21, 2021 -
MediumRLSA-2021:4593 1 CVE
Moderate: annobin security update
Annobin provides a compiler plugin to annotate and tools to examine compiled binary files. Security Fix(es): * Developer environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks (CVE-2021-42574) The following changes wer…
first Nov 10, 2021 -
Medium max 6.5RLSA-2024:3826 3 CVEs
Moderate: podman security and bug fix update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: * podman: jose-go: improper handling of highly comp…
first Jun 14, 2024 -
MediumRLSA-2024:3121 2 CVEs
Moderate: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122) * mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023…
first Jun 14, 2024 -
Medium max 7.4RLSA-2024:6757 1 CVE
Moderate: libnbd security update
Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: NBD server improper certificate validation (C…
first Sep 30, 2024 -
Medium max 6.5RLSA-2024:4861 2 CVEs
Moderate: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638) * squid: Out-of-bounds …
first Jul 26, 2024 -
Medium max 7.7RLSA-2022:7585 9 CVEs
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561) * libtiff: Null source pointer lead to Denial of Service via craft…
first Nov 8, 2022 -
Medium max 8.8
Moderate: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.36.7). Security Fix(es): * webkitgtk: processing maliciously crafted web content may l…
first Sep 15, 2022 -
MediumRLSA-2021:4231 8 CVEs
Moderate: libwebp security update
The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange…
first Nov 9, 2021 -
High max 8.7
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: race condition in net/can/bcm.c leads to local privilege escalation (CVE-2021-3609) * kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM ca…
first Aug 10, 2021 -
High max 3.7RLSA-2020:2755 1 CVE
Important: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080) For more details about the security issue(s), including the impac…
first Jun 25, 2020 -
Low max 3.2RLSA-2024:9325 1 CVE
Low: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Authenticated us…
first Mar 17, 2025 -
Medium max 6.8RLSA-2022:7790 1 CVE
Moderate: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Nov 8, 2022 -
Low max 9.8RLSA-2024:8922 1 CVE
Low: bzip2 security update
The bzip2 packages contain a freely available, high-quality data compressor. It provides both standalone compression and decompression utilities, as well as a shared library for use with other programs. Security Fix(es): * bzip2: out-of-bounds write in functi…
first Nov 8, 2024 -
Low max 3.7RLSA-2024:1939 1 CVE
Low: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.10.0. Security Fix(es): * Mozilla: Denial of Service using HTTP/2 CONTINUATION frames (CVE-2024-3302) For more details about the security issue(s), …
first May 6, 2024 -
MediumRLSA-2022:7622 2 CVEs
Moderate: unbound security, bug fix, and enhancement update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. The following packages have been upgraded to a later upstream version: unbound (1.16.2). (BZ#2027735) Security Fix(es): * unbound: the novel ghost domain where malicious…
first Nov 8, 2022 -
Medium max 9.1RLSA-2022:6449 6 CVEs
Moderate: nodejs:16 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-380…
first Sep 13, 2022 -
Medium max 5.3RLSA-2022:2092 1 CVE
Moderate: bind security, bug fix, and enhancement update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first May 10, 2022 -
HighRLSA-2024:3259 0 CVEs
Important: go-toolset:rhel8 security update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288) * golang: net/http/cookiejar: inco…
first Jun 14, 2024 -
Medium max 6.5RLSA-2023:4498 1 CVE
Moderate: dbus security update
D-Bus is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility. Security Fix(es): * dbus: dbus-daemon: assertion failure when a monitor is active and a m…
first Aug 24, 2023 -
High max 7.5RLSA-2023:3584 1 CVE
Important: c-ares security update
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067) For more details about the security issue(s), including the impact, …
first Jun 24, 2023 -
MediumRLSA-2022:7715 1 CVE
Moderate: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Incorrect server side include parsing can lead to XSS (CVE-2016-3709) For more details about the security issue(s), including the …
first Nov 8, 2022 -
High max 7.5RLSA-2022:0826 2 CVEs
Important: .NET 6.0 security and bugfix update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address security vulnerabilities are now available. The updated versions are .NET SDK…
first Mar 10, 2022 -
HighRLSA-2022:0323 1 CVE
Important: nginx:1.20 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. The following packages have been upgraded to a later upstream version: nginx (1.20.1). (BZ#2031030) Security Fix(es): * n…
first Jan 31, 2022 -
Medium max 7.8RLSA-2021:4162 11 CVEs
Moderate: python38:3.8 and python38-devel:3.8 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Nov 9, 2021 -
HighRLSA-2021:2264 3 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.11.0. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11 (CVE-2021-29967) * Mozilla: Thunderbird stored OpenPG…
first Jun 7, 2021 -
HighRLSA-2021:1242 1 CVE
Important: mariadb:10.3 and mariadb-devel:10.3 security update
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.28), galera (25.3.32). Security Fix(es): * mariadb: writable system variable…
first Apr 19, 2021