4,991 results · Feed
-
Medium max 6.1RLSA-2021:4158 1 CVE
Moderate: python-lxml security update
lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API. Security Fix(es): * python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957) For more details…
first Nov 9, 2021 -
High max 7.4RLSA-2021:2359 1 CVE
Important: dhcp security update
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay…
first Jun 9, 2021 -
HighRLSA-2021:0966 1 CVE
Important: pki-core:10.6 security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * pki-core: Unprivileged users can renew any certificate (CVE-2021-20179) For more details about the …
first Mar 23, 2021 -
MediumRLSA-2020:4634 1 CVE
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c (CVE-2019-17546) For more details about the secur…
first Nov 3, 2020 -
High max 9.8RLSA-2019:1529 4 CVEs
Important: pki-deps:10.6 security update
The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * tomcat: Due to a mishandling of close in NIO/NIO2 co…
first Jun 18, 2019 -
High max 8.1RLSA-2025:1736 1 CVE
Important: postgresql:13 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security …
first Feb 26, 2025 -
Medium max 7.5RLSA-2024:7349 1 CVE
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791) For more details about the securit…
first Oct 25, 2024 -
High max 7.5RLSA-2024:4165 1 CVE
Important: pki-core security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727) For more details about the sec…
first Jul 3, 2024 -
High max 8.4RLSA-2024:3959 1 CVE
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462) For more details about the security issue(s), including the impact, …
first Jul 2, 2024 -
High max 6.3RLSA-2024:3340 2 CVEs
Important: .NET 7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Jun 14, 2024 -
High max 8.8RLSA-2024:0012 11 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.6.0 ESR. Security Fix(es): * Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced<…
first Jan 9, 2024 -
High max 7.5
Important: go-toolset:rhel8 security update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: net/http, x/net/http2: rapid stream resets can cause excessive work [CVE-2023-44487] (CVE-2023-39325) * HTTP/2: Multiple HTTP…
first Oct 24, 2023 -
Medium max 7.5RLSA-2023:0833 3 CVEs
Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Feb 22, 2023 -
Medium max 7.3RLSA-2022:5319 2 CVEs
Moderate: vim security update
Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: heap buffer overflow (CVE-2022-1621) * vim: buffer over-read (CVE-2022-1629) For more details about the security issue(s), including the impact, a CVSS score, ackn…
first Jun 28, 2022 -
Medium max 8.2RLSA-2022:1821 5 CVEs
Moderate: python27:2.7 security update
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional…
first May 10, 2022 -
High max 7.6RLSA-2021:2291 1 CVE
Important: container-tools:2.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: vulnerable to symlink exchange attack (CVE-2021-30465) For more details about the security issue(s), including the impa…
first Jun 8, 2021 -
HighRLSA-2021:0611 1 CVE
Important: xterm security update
The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly. Security Fix(es): * xterm: crash when processing combining characters (CVE-…
first Feb 18, 2021 -
High max 8.1RLSA-2025:1737 1 CVE
Important: libpq security update
The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-…
first Feb 26, 2025 -
High max 9.8RLSA-2025:1283 8 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 (CVE-2…
first Feb 13, 2025 -
High max 9.8RLSA-2024:4211 61 CVEs
Important: kernel security and bug fix update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel: TCP-spoofed ghost ACKs and leak leak i…
first Jul 15, 2024 -
High max 7.8RLSA-2023:2074 1 CVE
Important: emacs security update
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: command injection vulnerability in org-mode (C…
first May 5, 2023 -
High max 7.8RLSA-2023:0284 1 CVE
Important: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sud…
first Jan 23, 2023 -
Medium max 5.3RLSA-2022:1861 1 CVE
Moderate: maven:3.5 security update
Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fix(es): * apache-httpclient: in…
first May 10, 2022 -
LowRLSA-2021:5238 2 CVEs
Low: virt:rhel and virt-devel:rhel security update
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also prov…
first Dec 21, 2021 -
HighRLSA-2021:2235 1 CVE
Important: pki-core:10.6 security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file (CVE-…
first Jun 3, 2021 -
High max 5.6RLSA-2020:2852 4 CVEs
Important: nodejs:12 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (12.18.2). Security Fix(es): * nghttp2: overly…
first Jul 7, 2020 -
Medium max 6.5RLSA-2024:0606 2 CVEs
Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * ssh: Prefix truncation attack on Binary Packet Prot…
first Feb 12, 2024 -
HighRLSA-2023:4462 9 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.14.0 ESR. Security Fix(es): * Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (…
first Aug 8, 2023 -
Medium max 8.1RLSA-2022:8833 2 CVEs
Moderate: nodejs:18 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18.12.1), nodejs-nodemon (2.0.20). (BZ#214281…
first Dec 6, 2022 -
Medium max 7.5RLSA-2022:7469 3 CVEs
Moderate: container-tools:4.0 security and bug fix update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708) * golang: crash in a golang.org/x/crypto/ssh…
first Nov 8, 2022 -
Medium max 7.5RLSA-2022:7105 1 CVE
Moderate: gnutls security update
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509) For more det…
first Oct 25, 2022 -
High max 8.8RLSA-2022:6702 6 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Security Fix(es): * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022…
first Sep 26, 2022 -
High max 7.5RLSA-2022:5696 3 CVEs
Important: java-1.8.0-openjdk security, bug fix, and enhancement update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07). (BZ#2084648) Security Fi…
first Jul 25, 2022 -
MediumRLSA-2021:4374 1 CVE
Moderate: file security update
The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graph…
first Nov 9, 2021 -
High max 9.8RLSA-2021:4130 9 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.3.0. Security Fix(es): * Mozilla: Use-after-free in HTTP2 Session object * Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3 * Moz…
first Nov 4, 2021 -
High max 6.8RLSA-2021:3891 10 CVEs
Important: java-11-openjdk security update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565) * OpenJDK: Inco…
first Oct 20, 2021 -
MediumRLSA-2021:2566 7 CVEs
Moderate: fwupd security update
The fwupd packages provide a service that allows session software to update device firmware. Security Fix(es): * grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled (CVE-2020-14372) * grub2: Use-after-free in rmm…
first Jun 29, 2021 -
High max 7.0RLSA-2021:0705 1 CVE
Important: container-tools:1.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * podman: container users permissions are not respected in privileged containers (CVE-2021-20188) For more details about the se…
first Mar 2, 2021 -
High max 8.5RLSA-2025:0673 1 CVE
Important: git-lfs security update
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * git-lfs: Git LFS permits exfiltration of credentials…
first Feb 13, 2025 -
Medium max 7.3RLSA-2024:3667 1 CVE
Moderate: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: command injectio…
first Jun 14, 2024