4,991 results · Feed
-
Medium max 6.7RLSA-2022:1759 29 CVEs
Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also prov…
first May 10, 2022 -
MediumRLSA-2021:1600 3 CVEs
Moderate: opensc security, bug fix, and enhancement update
The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. Security Fix(es): * opensc…
first May 18, 2021 -
High max 9.8RLSA-2024:6682 8 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: 115.15/128.2 ESR () * mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-83…
first Sep 17, 2024 -
High max 8.3RLSA-2024:2264 8 CVEs
Important: edk2 security update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Adverti…
first May 10, 2024 -
High max 9.8RLSA-2022:9067 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.6.0 ESR. Security Fix(es): * Mozilla: Arbitrary file read from a compromised content process (CVE-2022-…
first Dec 15, 2022 -
LowRLSA-2021:4387 1 CVE
Low: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135) For more details about the …
first Nov 9, 2021 -
Low max 8.8
Low: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of Rocky Linux. Security Fix(es): * evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459) * gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd …
first Nov 5, 2019 -
High max 7.4RLSA-2025:0222 1 CVE
Important: dpdk security update
The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fix(es): * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-…
first Jan 11, 2025 -
High max 9.1RLSA-2024:9548 1 CVE
Important: openexr security update
OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the …
first Nov 19, 2024 -
Medium max 7.5RLSA-2024:3005 1 CVE
Moderate: python-pillow security update
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es): * python-pillow: uncontrolled resource consum…
first Jun 14, 2024 -
Medium max 7.5RLSA-2024:0130 4 CVEs
Moderate: frr security update
FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406) * ffr: Out of bounds …
first Jan 12, 2024 -
HighRLSA-2023:7500 7 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.5.0. Security Fix(es): * Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204) * Mozilla: Use-after-free in MessagePort::Ent…
first Nov 28, 2023 -
High max 7.5RLSA-2023:3246 5 CVEs
Important: git security update
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision histor…
first May 25, 2023 -
HighRLSA-2022:7470 1 CVE
Important: pki-core:10.6 and pki-deps:10.6 security and bug fix update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414) For more det…
first Nov 8, 2022 -
High max 7.5RLSA-2022:6778 2 CVEs
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Oct 4, 2022 -
High max 8.8RLSA-2022:6164 5 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.13.0. Security Fix(es): * Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472) * Mozilla: Cross-origin XSLT Documents would have in…
first Aug 24, 2022 -
Medium max 7.5RLSA-2020:4654 2 CVEs
Moderate: python27:2.7 security update
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional…
first Nov 3, 2020 -
MediumRLSA-2019:3476 1 CVE
Moderate: squid:4 security and bug fix update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: XSS via user_name or auth parameter in cachemgr.cgi (CVE-2019-13345) For more details about the security issue(s), incl…
first Nov 5, 2019 -
Medium max 6.9
Moderate: gcc security update
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) …
first Feb 13, 2025 -
LowRLSA-2020:4469 1 CVE
Low: cups security and bug fix update
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c (CVE-2020-3898) For more details about th…
first Nov 3, 2020 -
High max 8.8RLSA-2025:0145 4 CVEs
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * WebKitGTK: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-54479) * webkit: Processing maliciously crafted …
first Jan 11, 2025 -
Medium max 7.8RLSA-2024:9056 1 CVE
Moderate: gstreamer1-plugins-base security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer: EXIF Metadata Parsing Integer Overflow …
first Nov 19, 2024 -
High max 7.5RLSA-2024:3271 3 CVEs
Important: bind and dhcp security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Jun 14, 2024 -
High max 7.9RLSA-2024:1687 7 CVEs
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (…
first May 6, 2024 -
High max 7.8RLSA-2023:1592 1 CVE
Important: tigervnc security update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
first Apr 6, 2023 -
Medium max 9.1RLSA-2022:6448 5 CVEs
Moderate: nodejs:14 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212) * nodejs: HTTP request smug…
first Sep 13, 2022 -
LowRLSA-2022:0889 1 CVE
Low: 389-ds:1.4 security and bug fix update
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: double free of the vi…
first Mar 15, 2022 -
HighRLSA-2021:3157 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.13.0 ESR. Security Fix(es): * Mozilla: Uninitialized memory in a canvas object could have led to memory …
first Aug 16, 2021 -
High max 8.0RLSA-2023:4517 6 CVEs
Important: kernel security and bug fix update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896) * kernel: tcindex: use-after-free vulnera…
first Oct 6, 2023 -
Medium max 6.5RLSA-2024:7550 1 CVE
Moderate: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related i…
first Oct 25, 2024 -
High max 8.8RLSA-2024:3264 1 CVE
Important: pcp security update
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of c…
first Jun 14, 2024 -
High max 7.5RLSA-2022:5775 10 CVEs
Important: go-toolset:rhel8 security and bug fix update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: net/http: improper sanitization of Transfer-Encodin…
first Aug 1, 2022 -
Medium max 5.3RLSA-2021:1702 1 CVE
Moderate: brotli security update
Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available g…
first May 18, 2021 -
Medium max 7.5RLSA-2021:0551 7 CVEs
Moderate: nodejs:14 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (14.15.4). Security Fix(es): * nodejs-npm-user…
first Feb 16, 2021 -
High max 7.8RXSA-2023:7749 4 CVEs
Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free vulnerability in the smb client component (CVE-2023-5345) * kernel: IGB driver inadequate buffer size for frames larger than MTU (…
first Jan 12, 2024 -
Medium max 6.5RLSA-2024:9401 7 CVEs
Moderate: microcode_ctl security update
The microcode_ctl packages provide microcode updates for Intel and AMD processors. Security Fix(es): * kernel: local privilege escalation on Intel microcode on Intel(R) Xeon(R) (CVE-2023-22655) * kernel: Local information disclosure on Intel(R) Atom(R) proces…
first Mar 17, 2025 -
Medium max 5.3RLSA-2024:11237 1 CVE
Moderate: libsndfile:1.0.31 security update
libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612) For more details about the securi…
first Mar 17, 2025 -
High max 8.8RLSA-2022:8637 1 CVE
Important: krb5 security update
Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the he…
first Nov 28, 2022 -
High max 7.5RLSA-2022:4661 1 CVE
Important: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * sinatra: path traversal possible outside of public_dir when serving static files (CVE-2022-29970) For more details about the security is…
first May 18, 2022 -
High max 6.5RLSA-2021:2570 2 CVEs
Important: kernel security and bug fix update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan (CVE-2021-33034) * kernel: security bypass in certs/blacklist.c and certs…
first Jun 29, 2021