{"result":"OK","data":{"search":[{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2024:1249","_score":7.0618267,"_source":{"id":"CESA-2024:1249","type":"centos","bulletinFamily":"unix","title":"bpftool, kernel, perf, python security update","description":"**CentOS Errata and Security Advisory** CESA-2024:1249\n\n\nAn update for kernel is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* (CVE-2024-26602, ?)\n\n* kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)\n\n* kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)\n\n* kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)\n\n* kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (CVE-2023-38409)\n\n* kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* [rhel-7] INFO: possible circular locking dependency detected: store+0x70/0xe0 kernfs_fop_write+0xe3/0x190 (BZ#2161654)\n\n* qedf: Reading /sys/kernel/debug/qedf/hostX/stop_io_on_error can cause panic (BZ#2224973)\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-March/099235.html\n\n**Affected packages:**\nbpftool\nkernel\nkernel-abi-whitelists\nkernel-debug\nkernel-debug-devel\nkernel-devel\nkernel-doc\nkernel-headers\nkernel-tools\nkernel-tools-libs\nkernel-tools-libs-devel\nperf\npython-perf\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2024:1249","published":"2024-03-25T15:37:48","modified":"2024-03-25T15:37:48","cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-March/099235.html","cvelist":["CVE-2022-42896","CVE-2023-38409","CVE-2023-45871","CVE-2023-4921","CVE-2024-1086","CVE-2024-26602"],"lastseen":"2026-03-28T22:14:06","vhref":"https://vulners.com/centos/CESA-2024:1249"},"sort":[7.0618267,1711381068000],"flatDescription":"CentOS Errata and Security Advisory CESA-2024:1249 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2024:0957","_score":7.0618267,"_source":{"id":"CESA-2024:0957","type":"centos","bulletinFamily":"unix","title":"thunderbird security update","description":"**CentOS Errata and Security Advisory** CESA-2024:0957\n\n\nAn update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 115.8.0.\n\nSecurity Fix(es):\n\n* Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)\n\n* Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)\n\n* Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8 (CVE-2024-1553)\n\n* Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)\n\n* Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)\n\n* Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants (CVE-2024-1550)\n\n* Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)\n\n* Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-February/099231.html\n\n**Affected packages:**\nthunderbird\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2024:0957","published":"2024-02-29T15:09:00","modified":"2024-02-29T15:09:00","cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security"},"cvss2":{},"cvss3":{"cvssV31":{"source":"security","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-February/099231.html","cvelist":["CVE-2024-1546","CVE-2024-1547","CVE-2024-1548","CVE-2024-1549","CVE-2024-1550","CVE-2024-1551","CVE-2024-1552","CVE-2024-1553"],"lastseen":"2026-03-28T22:14:06","vhref":"https://vulners.com/centos/CESA-2024:0957"},"sort":[7.0618267,1709219340000],"flatDescription":"CentOS Errata and Security Advisory CESA-2024:0957 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2024:0976","_score":7.0618267,"_source":{"id":"CESA-2024:0976","type":"centos","bulletinFamily":"unix","title":"firefox security update","description":"**CentOS Errata and Security Advisory** CESA-2024:0976\n\n\nAn update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 115.8.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)\n\n* Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)\n\n* Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8 (CVE-2024-1553)\n\n* Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)\n\n* Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)\n\n* Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants (CVE-2024-1550)\n\n* Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)\n\n* Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-February/099230.html\n\n**Affected packages:**\nfirefox\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2024:0976","published":"2024-02-29T15:08:24","modified":"2024-02-29T15:08:24","cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security"},"cvss2":{},"cvss3":{"cvssV31":{"source":"security","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-February/099230.html","cvelist":["CVE-2024-1546","CVE-2024-1547","CVE-2024-1548","CVE-2024-1549","CVE-2024-1550","CVE-2024-1551","CVE-2024-1552","CVE-2024-1553"],"lastseen":"2026-03-16T14:22:29","vhref":"https://vulners.com/centos/CESA-2024:0976"},"sort":[7.0618267,1709219304000],"flatDescription":"CentOS Errata and Security Advisory CESA-2024:0976 An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2024:0629","_score":7.0618267,"_source":{"id":"CESA-2024:0629","type":"centos","bulletinFamily":"unix","title":"tigervnc security update","description":"**CentOS Errata and Security Advisory** CESA-2024:0629\n\n\nAn update for tigervnc is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nVirtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.\n\nSecurity Fix(es):\n\n* xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816)\n\n* xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access (CVE-2024-0229)\n\n* xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885)\n\n* xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-February/099223.html\n\n**Affected packages:**\ntigervnc\ntigervnc-icons\ntigervnc-license\ntigervnc-server\ntigervnc-server-applet\ntigervnc-server-minimal\ntigervnc-server-module\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2024:0629","published":"2024-02-05T19:31:03","modified":"2024-02-05T19:31:03","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-February/099223.html","cvelist":["CVE-2023-6816","CVE-2024-0229","CVE-2024-21885","CVE-2024-21886"],"lastseen":"2026-03-28T22:14:06","vhref":"https://vulners.com/centos/CESA-2024:0629"},"sort":[7.0618267,1707161463000],"flatDescription":"CentOS Errata and Security Advisory CESA-2024:0629 An update for tigervnc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2024:0013","_score":7.0618267,"_source":{"id":"CESA-2024:0013","type":"centos","bulletinFamily":"unix","title":"gstreamer1 security update","description":"**CentOS Errata and Security Advisory** CESA-2024:0013\n\n\nAn update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nGStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.\n\nSecurity Fix(es):\n\n* gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-February/099222.html\n\n**Affected packages:**\ngstreamer1-plugins-bad-free\ngstreamer1-plugins-bad-free-devel\ngstreamer1-plugins-bad-free-gtk\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2024:0013","published":"2024-02-05T19:26:26","modified":"2024-02-05T19:26:26","cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"cvssV3":{"source":"zdi-disclosures@trendmicro.com","version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-February/099222.html","cvelist":["CVE-2023-44446"],"lastseen":"2026-03-16T14:22:27","vhref":"https://vulners.com/centos/CESA-2024:0013"},"sort":[7.0618267,1707161186000],"flatDescription":"CentOS Errata and Security Advisory CESA-2024:0013 An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2024:0320","_score":7.0618267,"_source":{"id":"CESA-2024:0320","type":"centos","bulletinFamily":"unix","title":"xorg security update","description":"**CentOS Errata and Security Advisory** CESA-2024:0320\n\n\nAn update for xorg-x11-server is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nX.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.\n\nSecurity Fix(es):\n\n* xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816)\n\n* xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access (CVE-2024-0229)\n\n* xorg-x11-server: SELinux unlabeled GLX PBuffer (CVE-2024-0408)\n\n* xorg-x11-server: SELinux context corruption (CVE-2024-0409)\n\n* xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885)\n\n* xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-January/099216.html\n\n**Affected packages:**\nxorg-x11-server-Xdmx\nxorg-x11-server-Xephyr\nxorg-x11-server-Xnest\nxorg-x11-server-Xorg\nxorg-x11-server-Xvfb\nxorg-x11-server-Xwayland\nxorg-x11-server-common\nxorg-x11-server-devel\nxorg-x11-server-source\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2024:0320","published":"2024-01-26T18:10:28","modified":"2024-01-26T18:10:28","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-January/099216.html","cvelist":["CVE-2023-6816","CVE-2024-0229","CVE-2024-0408","CVE-2024-0409","CVE-2024-21885","CVE-2024-21886"],"lastseen":"2026-03-16T14:22:33","vhref":"https://vulners.com/centos/CESA-2024:0320"},"sort":[7.0618267,1706292628000],"flatDescription":"CentOS Errata and Security Advisory CESA-2024:0320 An update for xorg-x11-server is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:7423","_score":7.0618267,"_source":{"id":"CESA-2023:7423","type":"centos","bulletinFamily":"unix","title":"bpftool, kernel, perf, python security update","description":"**CentOS Errata and Security Advisory** CESA-2023:7423\n\n\nAn update for kernel is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead (CVE-2023-3611)\n\n* kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)\n\n* kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)\n\n* hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-January/099208.html\n\n**Affected packages:**\nbpftool\nkernel\nkernel-abi-whitelists\nkernel-debug\nkernel-debug-devel\nkernel-devel\nkernel-doc\nkernel-headers\nkernel-tools\nkernel-tools-libs\nkernel-tools-libs-devel\nperf\npython-perf\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:7423","published":"2024-01-12T19:36:38","modified":"2024-01-12T19:36:38","cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-January/099208.html","cvelist":["CVE-2022-40982","CVE-2023-31436","CVE-2023-3611","CVE-2023-3776","CVE-2023-4128","CVE-2023-4206","CVE-2023-4207","CVE-2023-4208"],"lastseen":"2026-03-16T14:22:32","vhref":"https://vulners.com/centos/CESA-2023:7423"},"sort":[7.0618267,1705088198000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:7423 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:6805","_score":7.0618267,"_source":{"id":"CESA-2023:6805","type":"centos","bulletinFamily":"unix","title":"squid security update","description":"**CentOS Errata and Security Advisory** CESA-2023:6805\n\n\nAn update for squid is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nSquid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-January/099190.html\n\n**Affected packages:**\nsquid\nsquid-migration-script\nsquid-sysvinit\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:6805","published":"2024-01-12T19:20:23","modified":"2024-01-12T19:20:23","cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","source":"secalert@redhat.com"},"cvss2":{},"cvss3":{"cvssV31":{"source":"secalert@redhat.com","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-January/099190.html","cvelist":["CVE-2023-46847"],"lastseen":"2026-03-28T22:14:11","vhref":"https://vulners.com/centos/CESA-2023:6805"},"sort":[7.0618267,1705087223000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:6805 An update for squid is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:7279","_score":7.0618267,"_source":{"id":"CESA-2023:7279","type":"centos","bulletinFamily":"unix","title":"open security update","description":"**CentOS Errata and Security Advisory** CESA-2023:7279\n\n\nAn update for open-vm-tools is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.\n\nSecurity Fix(es):\n\n* open-vm-tools: SAML token signature bypass (CVE-2023-34058)\n\n* open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper (CVE-2023-34059)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-January/099184.html\n\n**Affected packages:**\nopen-vm-tools\nopen-vm-tools-desktop\nopen-vm-tools-devel\nopen-vm-tools-test\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:7279","published":"2024-01-12T19:15:38","modified":"2024-01-12T19:15:38","cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-January/099184.html","cvelist":["CVE-2023-34058","CVE-2023-34059"],"lastseen":"2026-03-16T14:22:30","vhref":"https://vulners.com/centos/CESA-2023:7279"},"sort":[7.0618267,1705086938000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:7279 An update for open-vm-tools is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2024:0027","_score":7.0618267,"_source":{"id":"CESA-2024:0027","type":"centos","bulletinFamily":"unix","title":"thunderbird security update","description":"**CentOS Errata and Security Advisory** CESA-2024:0027\n\n\nAn update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 115.6.0.\n\nSecurity Fix(es):\n\n* Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver (CVE-2023-6856)\n\n* Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 (CVE-2023-6864)\n\n* Mozilla: S/MIME signature accepted despite mismatching message date (CVE-2023-50761)\n\n* Mozilla: Truncated signed text was shown with a valid OpenPGP signature (CVE-2023-50762)\n\n* Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857)\n\n* Mozilla: Heap buffer overflow in <code>nsTextFragment</code> (CVE-2023-6858)\n\n* Mozilla: Use-after-free in PR_GetIdentitiesLayer (CVE-2023-6859)\n\n* Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation (CVE-2023-6860)\n\n* Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode (CVE-2023-6861)\n\n* Mozilla: Use-after-free in <code>nsDNSService</code> (CVE-2023-6862)\n\n* Mozilla: Undefined behavior in <code>ShutdownObserver()</code> (CVE-2023-6863)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2024-January/099173.html\n\n**Affected packages:**\nthunderbird\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2024:0027","published":"2024-01-12T18:58:02","modified":"2024-01-12T18:58:02","cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2024-January/099173.html","cvelist":["CVE-2023-50761","CVE-2023-50762","CVE-2023-6856","CVE-2023-6857","CVE-2023-6858","CVE-2023-6859","CVE-2023-6860","CVE-2023-6861","CVE-2023-6862","CVE-2023-6863","CVE-2023-6864"],"lastseen":"2026-03-16T14:22:29","vhref":"https://vulners.com/centos/CESA-2024:0027"},"sort":[7.0618267,1705085882000],"flatDescription":"CentOS Errata and Security Advisory CESA-2024:0027 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:4152","_score":7.0618267,"_source":{"id":"CESA-2023:4152","type":"centos","bulletinFamily":"unix","title":"bind security update","description":"**CentOS Errata and Security Advisory** CESA-2023:4152\n\n\nAn update for bind is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.\n\nSecurity Fix(es):\n\n* bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-August/086414.html\n\n**Affected packages:**\nbind\nbind-chroot\nbind-devel\nbind-export-devel\nbind-export-libs\nbind-libs\nbind-libs-lite\nbind-license\nbind-lite-devel\nbind-pkcs11\nbind-pkcs11-devel\nbind-pkcs11-libs\nbind-pkcs11-utils\nbind-sdb\nbind-sdb-chroot\nbind-utils\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:4152","published":"2023-08-03T14:24:41","modified":"2023-08-03T14:24:41","cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-officer@isc.org"},"cvss2":{},"cvss3":{"cvssV31":{"source":"security-officer@isc.org","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-August/086414.html","cvelist":["CVE-2023-2828"],"lastseen":"2026-03-28T22:14:13","vhref":"https://vulners.com/centos/CESA-2023:4152"},"sort":[7.0618267,1691072681000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:4152 An update for bind is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:3555","_score":7.0618267,"_source":{"id":"CESA-2023:3555","type":"centos","bulletinFamily":"unix","title":"python, tkinter security update","description":"**CentOS Errata and Security Advisory** CESA-2023:3555\n\n\nAn update for python is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nPython is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* python: urllib.parse url blocklisting bypass (CVE-2023-24329)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-July/086400.html\n\n**Affected packages:**\npython\npython-debug\npython-devel\npython-libs\npython-test\npython-tools\ntkinter\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:3555","published":"2023-07-27T14:34:23","modified":"2023-07-27T14:34:23","cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-July/086400.html","cvelist":["CVE-2023-24329"],"lastseen":"2026-03-16T14:22:33","vhref":"https://vulners.com/centos/CESA-2023:3555"},"sort":[7.0618267,1690468463000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:3555 An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:3741","_score":7.0618267,"_source":{"id":"CESA-2023:3741","type":"centos","bulletinFamily":"unix","title":"c security update","description":"**CentOS Errata and Security Advisory** CESA-2023:3741\n\n\nAn update for c-ares is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.\n\nSecurity Fix(es):\n\n* c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-July/086398.html\n\n**Affected packages:**\nc-ares\nc-ares-devel\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:3741","published":"2023-07-27T14:33:02","modified":"2023-07-27T14:33:02","cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-July/086398.html","cvelist":["CVE-2023-32067"],"lastseen":"2026-03-16T14:22:33","vhref":"https://vulners.com/centos/CESA-2023:3741"},"sort":[7.0618267,1690468382000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:3741 An update for c-ares is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:1791","_score":7.0618267,"_source":{"id":"CESA-2023:1791","type":"centos","bulletinFamily":"unix","title":"firefox security update","description":"**CentOS Errata and Security Advisory** CESA-2023:1791\n\n\nAn update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 102.10.0 ESR.\n\nSecurity Fix(es):\n\n* MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102)\n\n* Mozilla: Fullscreen notification obscured (CVE-2023-29533)\n\n* Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535)\n\n* Mozilla: Invalid free from JavaScript code (CVE-2023-29536)\n\n* Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550)\n\n* Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945)\n\n* Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539)\n\n* Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541)\n\n* Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-April/086396.html\n\n**Affected packages:**\nfirefox\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:1791","published":"2023-04-24T17:46:00","modified":"2023-04-24T17:46:00","cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-April/086396.html","cvelist":["CVE-2023-1945","CVE-2023-1999","CVE-2023-29533","CVE-2023-29535","CVE-2023-29536","CVE-2023-29539","CVE-2023-29541","CVE-2023-29548","CVE-2023-29550"],"lastseen":"2026-03-28T22:14:16","vhref":"https://vulners.com/centos/CESA-2023:1791"},"sort":[7.0618267,1682358360000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:1791 An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:1875","_score":7.0618267,"_source":{"id":"CESA-2023:1875","type":"centos","bulletinFamily":"unix","title":"java security update","description":"**CentOS Errata and Security Advisory** CESA-2023:1875\n\n\nAn update for java-11-openjdk is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.\n\nSecurity Fix(es):\n\n* OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930)\n\n* OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939)\n\n* OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954)\n\n* OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967)\n\n* OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937)\n\n* OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938)\n\n* OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-April/086394.html\n\n**Affected packages:**\njava-11-openjdk\njava-11-openjdk-demo\njava-11-openjdk-devel\njava-11-openjdk-headless\njava-11-openjdk-javadoc\njava-11-openjdk-javadoc-zip\njava-11-openjdk-jmods\njava-11-openjdk-src\njava-11-openjdk-static-libs\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:1875","published":"2023-04-24T14:47:41","modified":"2023-04-24T14:47:41","cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"secalert_us@oracle.com"},"cvss2":{},"cvss3":{"cvssV31":{"source":"secalert_us@oracle.com","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-April/086394.html","cvelist":["CVE-2023-21930","CVE-2023-21937","CVE-2023-21938","CVE-2023-21939","CVE-2023-21954","CVE-2023-21967","CVE-2023-21968"],"lastseen":"2026-05-28T20:10:41","vhref":"https://vulners.com/centos/CESA-2023:1875"},"sort":[7.0618267,1682347661000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:1875 An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:1091","_score":7.0618267,"_source":{"id":"CESA-2023:1091","type":"centos","bulletinFamily":"unix","title":"bpftool, kernel, perf, python security update","description":"**CentOS Errata and Security Advisory** CESA-2023:1091\n\n\nAn update for kernel is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)\n\n* kernel: use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Regression - SAS3416 card works on RHEL 7.7 and below, does not work on RHEL 7.8 or 7.9 (BZ#1974485)\n\n* use-after-free in sctp_do_8_2_transport_strike (BZ#2054037)\n\n* RHEL7.9 - [Regression] Kernel test failed during CPU polarization test - lscpu, chcpu - LPAR (BZ#2071980)\n\n* RHEL 7, block: Crash in blk_mq_rq_timed_out() when dereferencing NULL request->q pointer (BZ#2088029)\n\n* qla2xxx: Qlogic double completion races during error handling are still not fixed and this will also  be a RHEL8+ exposure (BZ#2092105)\n\n* kernel 3.10.0-1160.80.1.el7.x86_64 on Xeon E55xx crashes upon KVM startup (BZ#2143438)\n\n* Guest's time jumped forward by 12 minutes _after_ live-migration completes (in 30 seconds) (BZ#2152838)\n\n* RHEL7: target crashes if a malicious initiator sends a logout immediately after a login command (BZ#2154243)\n\n* RHEL7.9 - LTP testcase creat09 fails related to 'CVE-2018-13405' and 'CVE-2021-4037` (BZ#2159946)\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-March/086390.html\n\n**Affected packages:**\nbpftool\nkernel\nkernel-abi-whitelists\nkernel-debug\nkernel-debug-devel\nkernel-devel\nkernel-doc\nkernel-headers\nkernel-tools\nkernel-tools-libs\nkernel-tools-libs-devel\nperf\npython-perf\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:1091","published":"2023-03-08T16:36:50","modified":"2023-03-08T16:36:50","cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{"cvssV2":{"source":"nvd","version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false,"temporalScore":4.6}},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-March/086390.html","cvelist":["CVE-2018-13405","CVE-2022-42703","CVE-2022-4378"],"lastseen":"2026-06-25T12:13:16","vhref":"https://vulners.com/centos/CESA-2023:1091"},"sort":[7.0618267,1678293410000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:1091 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:0817","_score":7.0618267,"_source":{"id":"CESA-2023:0817","type":"centos","bulletinFamily":"unix","title":"thunderbird security update","description":"**CentOS Errata and Security Advisory** CESA-2023:0817\n\n\nAn update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[Updated 09 March 2023]\n\nThe CVE-2023-0767 was previously incorrectly listed as fixed in this erratum. The CVE list was updated to remove the CVE. No changes have been made to the packages.\n\nMozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.8.0.\n\nSecurity Fix(es):\n\n* Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)\n\n* Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)\n\n* Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)\n\n* Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)\n\n* Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)\n\n* Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)\n\n* Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)\n\n* Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)\n\n* Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)\n\n* Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)\n\n* Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616)\n\n* Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-February/086375.html\n\n**Affected packages:**\nthunderbird\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:0817","published":"2023-02-22T17:48:54","modified":"2023-02-22T17:48:54","cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-February/086375.html","cvelist":["CVE-2023-0616","CVE-2023-0767","CVE-2023-25728","CVE-2023-25729","CVE-2023-25730","CVE-2023-25732","CVE-2023-25735","CVE-2023-25737","CVE-2023-25739","CVE-2023-25742","CVE-2023-25743","CVE-2023-25744","CVE-2023-25746"],"lastseen":"2026-03-28T22:14:17","vhref":"https://vulners.com/centos/CESA-2023:0817"},"sort":[7.0618267,1677088134000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:0817 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:0600","_score":7.0618267,"_source":{"id":"CESA-2023:0600","type":"centos","bulletinFamily":"unix","title":"thunderbird security update","description":"**CentOS Errata and Security Advisory** CESA-2023:0600\n\n\nAn update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.7.1.\n\nSecurity Fix(es):\n\n* Mozilla: Revocation status of S/Mime signature certificates was not checked (CVE-2023-0430)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-February/086374.html\n\n**Affected packages:**\nthunderbird\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:0600","published":"2023-02-20T16:17:35","modified":"2023-02-20T16:17:35","cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-February/086374.html","cvelist":["CVE-2023-0430"],"lastseen":"2026-03-16T14:22:37","vhref":"https://vulners.com/centos/CESA-2023:0600"},"sort":[7.0618267,1676909855000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:0600 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2022:8799","_score":7.0618267,"_source":{"id":"CESA-2022:8799","type":"centos","bulletinFamily":"unix","title":"pki security update","description":"**CentOS Errata and Security Advisory** CESA-2022:8799\n\n\nAn update for pki-core is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.\n\nSecurity Fix(es):\n\n* pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-January/086368.html\n\n**Affected packages:**\npki-base\npki-base-java\npki-ca\npki-javadoc\npki-kra\npki-server\npki-symkey\npki-tools\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2022:8799","published":"2023-01-30T16:45:39","modified":"2023-01-30T16:45:39","cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"nvd"},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-January/086368.html","cvelist":["CVE-2022-2414"],"lastseen":"2026-03-28T22:14:20","vhref":"https://vulners.com/centos/CESA-2022:8799"},"sort":[7.0618267,1675097139000],"flatDescription":"CentOS Errata and Security Advisory CESA-2022:8799 An update for pki-core is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity..."},{"_index":"es6_bulletins_bulletin_v8","_id":"CESA-2023:0203","_score":7.0618267,"_source":{"id":"CESA-2023:0203","type":"centos","bulletinFamily":"unix","title":"java security update","description":"**CentOS Errata and Security Advisory** CESA-2023:0203\n\n\nAn update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.\n\nSecurity Fix(es):\n\n* OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830)\n\n* OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Prepare for the next quarterly OpenJDK upstream release (2023-01, 8u362) (BZ#2150191)\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2023-January/086357.html\n\n**Affected packages:**\njava-1.8.0-openjdk\njava-1.8.0-openjdk-accessibility\njava-1.8.0-openjdk-demo\njava-1.8.0-openjdk-devel\njava-1.8.0-openjdk-headless\njava-1.8.0-openjdk-javadoc\njava-1.8.0-openjdk-javadoc-zip\njava-1.8.0-openjdk-src\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2023:0203","published":"2023-01-30T16:39:46","modified":"2023-01-30T16:39:46","cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"secalert_us@oracle.com"},"cvss2":{},"cvss3":{"cvssV31":{"source":"secalert_us@oracle.com","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},"href":"https://lists.centos.org/pipermail/centos-announce/2023-January/086357.html","cvelist":["CVE-2023-21830","CVE-2023-21843"],"lastseen":"2026-03-16T14:22:38","vhref":"https://vulners.com/centos/CESA-2023:0203"},"sort":[7.0618267,1675096786000],"flatDescription":"CentOS Errata and Security Advisory CESA-2023:0203 An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed..."}],"occurrences":{},"exactMatch":null,"references":null,"total":3708,"maxSearchSize":100}}