4,991 results · Feed
-
High max 8.8RLSA-2022:6708 10 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.3.0. Security Fix(es): * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag (CVE-2022-3033…
first Sep 26, 2022 -
Medium max 7.5RLSA-2022:5314 2 CVEs
Moderate: expat security update
Expat is a C library for parsing XML documents. Security Fix(es): * expat: stack exhaustion in doctype parsing (CVE-2022-25313) * expat: integer overflow in copyString() (CVE-2022-25314) For more details about the security issue(s), including the impact, a CV…
first Jun 28, 2022 -
MediumRLSA-2021:1811 5 CVEs
Moderate: libvncserver security update
LibVNCServer is a C library that enables you to implement VNC server functionality into own programs. Security Fix(es): * libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247) * libvncserver: buffer overflow in Connec…
first May 18, 2021 -
High max 7.5RLSA-2024:4624 3 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * Mozilla: Race condition in permission assignment (CVE-2024-6601) * Mozilla: Memory corruption in thread creation (CVE-2024-6603) * Mozilla: Memory safety bugs fixed in Firefox …
first Jul 26, 2024 -
High max 7.5RLSA-2024:0806 2 CVEs
Important: dotnet7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Mar 12, 2024 -
LowRLSA-2020:1616 1 CVE
Low: irssi security update
Irssi is a modular IRC client with Perl scripting. Security Fix(es): * irssi: use after free when sending SASL login to server (CVE-2019-13045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other relate…
first Apr 28, 2020 -
Low max 9.1RLSA-2024:7848 1 CVE
Low: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: SSL_select_next_proto buffer overread (CVE-2024-553…
first Oct 25, 2024 -
Medium max 7.0RLSA-2023:3819 1 CVE
Moderate: kernel-rt security and bug fix update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dere…
first Aug 31, 2023 -
Medium max 5.5RLSA-2023:0336 1 CVE
Moderate: systemd security update
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of …
first Jan 23, 2023 -
Medium max 7.5RLSA-2022:7648 6 CVEs
Moderate: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: net/http: improper sanitizat…
first Nov 8, 2022 -
Medium max 5.3RLSA-2021:4161 1 CVE
Moderate: python-jinja2 security update
The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Security Fix(es): * python-jinja2: ReDoS vulnerability…
first Nov 9, 2021 -
Low max 6.9
Low: pcs security, bug fix, and enhancement update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594) Security Fix(es): * jquery: Cross-site scripting (XSS) vi…
first Nov 9, 2021 -
LowRLSA-2021:1935 2 CVEs
Low: rust-toolset:rhel8 security, bug fix, and enhancement update
Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. The following packages have been upgraded to a later upstream version: rust (1.49.0). (BZ#1896712) Security Fix(es): * rust: use-after-free or d…
first May 18, 2021 -
Medium max 5.9RLSA-2024:2463 1 CVE
Moderate: systemd security update
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of …
first May 10, 2024 -
High max 7.5RLSA-2024:1646 1 CVE
Important: grafana security and bug fix update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) Bug Fix(es): * TRIAGE CVE-2024-1…
first Apr 5, 2024 -
HighRLSA-2020:0348 2 CVEs
Important: container-tools:rhel8 security, bug fix, and enhancement update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039) For more details about the security…
first Feb 4, 2020 -
Medium max 4.8RLSA-2024:8127 5 CVEs
Moderate: java-21-openjdk security update
The OpenJDK 21 runtime environment. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxH…
first Oct 25, 2024 -
Medium max 8.8RLSA-2023:3821 3 CVEs
Moderate: ruby:2.7 security, bug fix, and enhancement update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (2.7). (BZ#2189465) Security Fix…
first Aug 31, 2023 -
Medium max 5.3RLSA-2023:0208 2 CVEs
Moderate: java-1.8.0-openjdk security and bug fix update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830) * OpenJDK: so…
first Jan 26, 2023 -
Medium max 8.8RLSA-2022:7623 1 CVE
Moderate: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided a…
first Nov 8, 2022 -
Medium max 7.8RLSA-2022:1935 2 CVEs
Moderate: php:7.4 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: Local privilege escalation via PHP-FPM (CVE-2021-21703) * php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705) For more details about the securi…
first May 10, 2022 -
Medium max 5.3RLSA-2022:0185 15 CVEs
Moderate: java-11-openjdk security update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934) (CVE-2022-2124…
first Jan 24, 2022 -
HighRLSA-2021:2290 1 CVE
Important: nginx:1.16 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name …
first Jun 8, 2021 -
Medium max 6.1RLSA-2021:1898 1 CVE
Moderate: python-lxml security update
lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API. Security Fix(es): * python-lxml: mXSS due to the use of improper parser (CVE-2020-27783) For more details about the security issue(s), includ…
first May 18, 2021 -
Medium max 7.0RLSA-2024:4457 1 CVE
Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Possible remote code execution due to a ra…
first Jul 15, 2024 -
Medium max 5.9RLSA-2024:2985 4 CVEs
Moderate: python39:3.9 and python39-devel:3.9 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Jun 14, 2024 -
Medium max 6.5RLSA-2023:6245 1 CVE
Moderate: .NET 6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Nov 11, 2023 -
Medium max 6.5RLSA-2023:5144 1 CVE
Moderate: .NET 6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Sep 19, 2023 -
High max 9.6RLSA-2022:0510 7 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.6.0 ESR. Security Fix(es): * Mozilla: Extensions could have bypassed permission confirmation during upda…
first Feb 14, 2022 -
Medium max 9.8
Moderate: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of Rocky Linux. The following packages have been upgraded to a later upstream version: gdm (40.0), webkit2gtk3 (2.32.3). (BZ#1909300) Security Fix(es): * webkitgtk: Use-after-free in AudioSourceProviderGStreamer leadin…
first Nov 9, 2021 -
Medium max 9.8RLSA-2020:1644 12 CVEs
Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig (CVE-2019-14540) * jackso…
first Apr 28, 2020 -
High max 7.8RXSA-2023:0334 6 CVEs
Important: kernel security and bug fix update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959) * kernel: memory corruption in AX88179_178A based USB ethernet device…
first Jan 23, 2023 -
High max 7.5RLSA-2024:7135 1 CVE
Important: git-lfs security update
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a me…
first Sep 30, 2024 -
High max 8.8RLSA-2024:10785 3 CVEs
Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes…
first Dec 19, 2024 -
MediumRLSA-2022:1915 4 CVEs
Moderate: httpd:2.4 security and bug fix update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193) * httpd: mod_proxy_uwsgi: out-of-bounds read via a cra…
first May 10, 2022 -
MediumRLSA-2021:4426 2 CVEs
Moderate: ncurses security update
The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, …
first Nov 9, 2021 -
Medium max 7.5RLSA-2024:6529 2 CVEs
Moderate: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided …
first Sep 17, 2024 -
MediumRLSA-2024:3066 2 CVEs
Moderate: exempi security update
Exempi provides a library for easy parsing of XMP metadata. Security Fix(es): * exempi: denial of service via opening of crafted audio file with ID3V2 frame (CVE-2020-18651) * exempi: denial of service via opening of crafted webp file (CVE-2020-18652) For mor…
first Jun 14, 2024 -
Medium max 6.1RLSA-2024:2961 1 CVE
Moderate: Image builder components bug fix, enhancement and security update
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fix(es): * osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)…
first Jun 14, 2024 -
Medium max 5.5RLSA-2023:7190 1 CVE
Moderate: avahi security update
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network …
first Nov 28, 2023