8.1 security update

php-pecl-apcu 5.1.21-1 - update to 5.1.21 for PHP 8.1 2070040 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040 php-pecl-xdebug3 3.1.4-1 - update to 3.1.4 for PHP 8.1 2070040 php-pecl-zip 1.20.1-1 - update to 1.20.1 for PHP 8.1 2070040 php 8.1.14-1 - rebase to 8.1.14 8.1.8-1 - update to 8.1.8...

Unbreakable Enterprise kernel security update

4.14.35-2047.502.4 - Revert 'rds: ib: Remove two ibmodifyqp calls' Sharath Srinivasan Orabug: 32715567 - uek-rpm: Update SecureBoot Digicert 2021 certificates Somasundaram Krishnasamy Orabug: 32532514 4.14.35-2047.502.3 - video: hypervfb: Fix the mmap regression for v5.4.y and older Dexuan Cui...

Unbreakable Enterprise kernel security update

2.6.39-400.297.3 - nfsd: check for oversized NFSv2/v3 arguments J. Bruce Fields Orabug: 26366024 CVE-2017-7645 2.6.39-400.297.2 - dm mpath: allow ioctls to trigger pg init Mikulas Patocka Orabug: 25645229 - xen/manage: Always freeze/thaw processes when suspend/resuming Ross Lagerwall Orabug:...

httpd security, bug fix, and enhancement update

2.4.6-95.0.1 - replace index.html with Oracles index page oracleindex.html 2.4.6-95 - Resolves: 1823262 - CVE-2020-1934 httpd: modproxyftp use of uninitialized value 2.4.6-94 - Resolves: 1565491 - CVE-2017-15715 httpd: bypass with a trailing newline in the file name - Resolves: 1747283 -...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.35.2 - tcp: enforce tcpminsndmss in tcpmtuprobing Eric Dumazet Orabug: 29886600 CVE-2019-11477 - tcp: add tcpminsndmss sysctl Eric Dumazet Orabug: 29884307 CVE-2019-11479 - tcp: tcpfragment should apply sane memory limits Eric Dumazet Orabug: 29884307 CVE-2019-11478 - tcp: f...

thunderbird security update

60.7.2-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 60.7.2-2 - Update to 60.7.2 build2 60.7.2-1 - Update to 60.7.2 60.7.1-1 - Update to 60.7.1...

Unbreakable Enterprise kernel security update

5.15.0-101.103.2.1 - Revert 'attr: use consistent sgid stripping checks' Sherry Yang Orabug: 35346968 - Revert 'iommu: Force iommu shutdown on panic' Boris Ostrovsky Orabug: 35346963 5.15.0-101.103.2 - uek-rpm: mod-extra: Remove mt7921e.ko from extras list Harshit Mogalapalli Orabug: 34999685 -...

httpd:2.4/httpd security update

httpd 2.4.37-65.0.1 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65 - Resolves: RHEL-31857 - httpd:2.4/httpd: HTTP response splitting CVE-2023-38709 modhttp2 modmd...

java-1.8.0-openjdk security and bug fix update

1:1.8.0.302.b08-0 - Update to aarch64-shenandoah-jdk8u302-b08 EA - Update release notes for 8u302-b08. - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz1972395 1:1.8.0.302.b07-0.0.ea - Update to aarch64-shenandoah-jdk8u302-b07 EA - Upda...

kernel security update

2.6.9-89.0.29.0.1.EL - XEN fix cpu hotplug crash Joe Jin orabug 7521308 - XEN Bring up vcpus before khelper init Joe Jin orabug 7521308 - XEN flush the tlb cache immediately Dave McCracken, Scott Shi orabug 9138767 - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug...

qemu security update

15:4.2.1-4.el7 - Document CVE-2020-25723 as fixed Mark Kanda Orabug: 32222397 CVE-2020-25084 CVE-2020-25723 - hw/net/e1000e: advance descoffset in case of null descriptor Prasad J Pandit Orabug: 32217517 CVE-2020-28916 - i386: Add 2nd Generation AMD EPYC processors Moger, Babu Orabug: 32217570 -...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.34.1 - Input: wacom - move the USB now hid Wacom driver in drivers/hid Benjamin Tissoires Orabug: 25512494 CVE-2016-3139 - net: qmiwwan: fix divide by 0 on bad descriptors Bjorn Mork Orabug: 27215229 CVE-2017-16650 - USB: hso: Fix OOB memory access in hsoprobe/hsogetconfigda...

Unbreakable Enterprise kernel security update

4.1.12-124.78.2 - xfrm: fix crash in XFRMMSGGETSA netlink handler Vegard Nossum Orabug: 35598955 CVE-2023-3106 - netfilter: nftables: validate registers coming from userspace Harshvardhan Jha Orabug: 34012909 CVE-2022-1015 4.1.12-124.78.1 - vcscreen: move load of struct vcdata pointer in vcsread ...

openssl security and bug fix update

3.0.1-41.0.1 - Replace upstream references Orabug: 34340177 1:3.0.1-41 - Zeroize public keys as required by FIPS 140-3 Resolves: rhbz2115861 - Add FIPS indicator for HKDF Resolves: rhbz2118388 1:3.0.1-40 - Deal with DH keys in FIPS mode according FIPS-140-3 requirements Related: rhbz2115856 - Dea...

docker-engine security update

docker-engine 18.09.1-1.0.8 - cherry-picked fix for CVE-2018-15664 from upstream 18.09.1-1.0.7 - added runc version requirement 18.09.1-1.0.6 - disable kmem accounting for UEKR4 docker-cli 18.09.1-1.0.8 - rebuild 18.09.1-1.0.7 - rebuild 18.09.1-1.0.6 - disable kmem accounting for UEKR4 runc...

Unbreakable Enterprise kernel security update

2.6.39-400.312.1 - Bluetooth: hidp: fix buffer overflow Young Xiao Orabug: 29786788 CVE-2011-1079 CVE-2019-11884 - x86/speculation/mds: Fix verw usage to use memory operand Patrick Colp Orabug: 29791037 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 - x86/speculation/mds: Make...

Unbreakable Enterprise kernel security and bugfix update

4.1.12-112.14.1 - ext4: fix off-by-one on max nrpages in ext4findunwrittenpgoff Eryu Guan Orabug: 27233471 4.1.12-112.13.1 - cgroup: make sure a parent css isnt offlined before its children Tejun Heo Orabug: 27179269 4.1.12-112.12.1 - ctf: allow dwarf2ctf to run as root but produce no output Nick...

java-1.8.0-openjdk security update

1:1.8.0.242.b08-0 - Update to aarch64-shenandoah-jdk8u242-b08. - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions. - Resolves: rhbz1785753 1:1.8.0.242.b07-1 - Add backports of JDK-8031111 & JDK-8132111 to fix TCK issue. - Resolves: rhbz1785753 1:1.8.0.242.b07-0 -...

java-1.7.0-openjdk security update

1:1.7.0.261-2.6.22.2.0.1 - Update DISTRONAME in specfile 1:1.7.0.261-2.6.22.2 - Modify NEWS installation to avoid subpackage naming. - Resolves: rhbz1810557 1:1.7.0.261-2.6.22.1 - Add release notes from IcedTea. - Mark license files with appropriate macro. - Resolves: rhbz1810557...

Unbreakable Enterprise kernel security update

4.14.35-1844.1.3 - net: rds: fix rdsibsysctlmaxrecvallocation error Zhu Yanjun Orabug: 29003422 - nfs: dont dirty kernel pages read by direct-io Dave Kleikamp Orabug: 29122062 - KVM: X86: Fix scan ioapic use-before-initialization Wanpeng Li Orabug: 29026132 CVE-2018-19407 - hugetlb: take PMD...

openssl security update

1.0.1e-30.2 - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 1.0.1e-30 - add ECC TLS extensions to DTLS 1119800 1.0.1e-29 - fix CVE-2014-3505...

systemd security, bug fix, and enhancement update

219-67.0.1 - do not create utmp update symlinks for reboot and poweroff Orabug: 27854896 - OL7 udev rule for virtio net standby interface Orabug: 28826743 - fix netdev is missing for iscsi entry in /etc/fstab Orabug: 25897792 [email protected] - set 'RemoveIPC=no' in logind.conf as default fo...

httpd:2.4 security update

httpd 2.4.37-51.5.0.1 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-51.5 - Resolves: 2177747 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting with modrewrite and modproxy 2.4.37-51.1 - Resolves: 2165967 -...

sudo security update

1.8.23-10.1 - RHEL 7.9.Z ERRATUM - CVE-2021-3156 Resolves: rhbz1917729...

Unbreakable Enterprise kernel security update

4.14.35-1902.5.2.2 - KVM: coalescedmmio: add bounds checking Matt Delco Orabug: 30318013 CVE-2019-14821 CVE-2019-14821...

openssl security update

1.0.1e-58.0.1 - Oracle bug 28730228: backport CVE-2018-0732 - Oracle bug 28758493: backport CVE-2018-0737 - Merge upstream patch to fix CVE-2018-0739 - Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.1e-58 - fi...

kubernetes security update

kubernetes 1.12.10-1.0.10 - CVE-2019-16276 Kubernetes Vulnerabilities Allow Authentication Bypass, DoS 1.12.10-1.0.9 - Define rolling update for flannel 1.12.10-1.0.8 - Modify flannel/dashboard image tags to use images that have the cve fix kubeadm-ha-setup 0.0.2-1.0.68 - Pull image prior to upda...

curl security and bug fix update

7.29.0-51.0.1.el76.3 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison https://curl.haxx.se/docs/CVE-2016-8616.html - CVE-2016-8617 OOB write via unchecked...

kernel security and bug fix update

3.10.0-693.21.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-693.21.1 - x86 platform/uv: Mark tscchecksync as an init function Frank Ramsay...

openssh security update

8.7p1-30 - Avoid remote code execution in ssh-agent PKCS11 support Resolves: CVE-2023-38408...

Unbreakable Enterprise kernel security update

4.14.35-1902.3.1 - x86/platform/UV: Mark tscchecksync as an init function [email protected] Orabug: 29701029 - mm, pagealloc: check for max order in hot path Michal Hocko Orabug: 29924411 - net/mlx5: FW tracer, Enable tracing Feras Daoud Orabug: 29717200 - net/mlx5: FW tracer, parse traces and...

rsync security update

3.1.3-20 - Resolves: RHEL-70157 - Info Leak via Uninitialized Stack Contents...

Unbreakable Enterprise kernel security update

5.4.17-2036.103.3 - Revert 'rds: Deregister all FRWR mr with freemr' aru kolappan Orabug: 32426610 5.4.17-2036.103.2 - A/A Bonding: Fix a one-byte-off kmalloc Hakon Bugge Orabug: 32380824 - netfilter: add and use nfhookslowlist Florian Westphal Orabug: 32372530 CVE-2021-20177 - net/rds: Fix gfpt...

apache-commons-beanutils security update

1.8.3-15 - Fix CVE-2014-0114 - Fix CVE-2019-10086...

curl security update

7.61.1-22.el86.3 - fix too eager reuse of TLS and SSH connections CVE-2022-27782 7.61.1-22.el86.2 - fix invalid type in printf argument detected by Coverity 7.61.1-22.el86.1 - fix credential leak on redirect CVE-2022-27774 - fix auth/cookie leak on redirect CVE-2022-27776 - fix OAUTH2 bearer bypa...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.36.1 - tun: call devgetvalidname before registernetdevice Cong Wang Orabug: 29925557 CVE-2018-7191...

qemu security update

15:4.2.1-10.el7 - e1000: fail early for evil descriptor Jason Wang Orabug: 32560552 CVE-2021-20257 - Document CVE-2020-27661 as fixed Mark Kanda Orabug: 32960200 CVE-2020-27661 - block: Avoid stale pointer dereference in blkgetaiocontext Greg Kurz - block: Fix blk-inflight during...

container-tools:ol8 security and bug fix update

buildah 1.9.0-5.0.1 - Fixes troubles with oracle registry login Orabug: 29937283 1.9.0-5 - Use autosetup macro again. 1.9.0-4 - Fix CVE-2019-10214 1734653. 1.9.0-3 - Resolves: 1721247 - enable fips mode 1.9.0-2 - Resolves: 1720654 - tests subpackage depends on golang explicitly 1.9.0-1 - Resolves...

389-ds-base security and bug fix update

1.3.8.4-25.1 - Bump version to 1.3.8.4-25.1 - Resolves: Bug 1718689 - dse.ldif strip-off string after 1023 character missing patch file 1.3.8.4-25 - Bump version to 1.3.8.4-25 - Resolves: Bug 1722828 - referint update should discard any changes if mep update fails - Resolves: Bug 1718689 - dse.ld...

ruby:2.7 security update

ruby 2.7.4-137 - Upgrade to Ruby 2.7.4. - Fix command injection vulnerability in RDoc. Resolves: rhbz1986768 - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host. Resolves: rhbz1986812 - Fix StartTLS stripping vulnerability in Net::IMAP. Resolves: rhbz1986813 - Upgrade ...

java-1.8.0-openjdk security update

1:1.8.0.292.b10-0 - Update to aarch64-shenandoah-jdk8u292-b10 GA - Update release notes for 8u292-b10. - Update tarball generation script to use PR3822 which handles JDK-8233228 & JDK-8035166 changes - Remove RH1868759 patch as this is now resolved upstream by JDK-8258833. - Re-organise S/390...

Unbreakable Enterprise kernel security update

4.1.12-124.30.1 - xen: let allocxenballoonedpages fail if not enough memory free Juergen Gross Orabug: 30073695 - mm/pagealloc.c: calculate 'available' memory in a separate function Igor Redko Orabug: 30073695 - Input: gtco - bounds check collection indent level Grant Hernandez Orabug: 30074413...

bind security update

32:9.8.2-0.68.rc1.0.3.8 - Backport fix for CVE-2018-5741 Orabug: 33496185 32:9.8.2-0.68.rc1.0.2.8 - Backport possible assertion failure on DNAME processing CVE-2021-25215 32:9.8.2-0.68.rc1.0.1.8 - Backport the fix for buffer overflow CVE-2020-8625 Orabug: 32588749 32:9.8.2-0.68.rc1.8 - Fix...

httpd security update

2.2.15-69.0.4 - modproxy: approxyhttprequest to clear hop-by-hop first and fixup last CVE-2022-31813Orabug: 34317859 2.2.15-69.0.3 - core: Simpler connection close logic CVE-2022-22720Orabug: 33991577...

docker-engine security update

18.09.8-1.0.4 - Modified version to include ol suffix 18.09.8-1.0.3 - ol7 image related changes 18.09.8-1.0.2 - Merge upstream for CVE fixes...

Unbreakable Enterprise kernel security update

2.6.39-400.311.1 - USB: hso: Fix OOB memory access in hsoprobe/hsogetconfigdata Hui Peng CVE-2018-19985 CVE-2018-19985 - binfmtelf: switch to new creds when switching to new mm Linus Torvalds Orabug: 29677235 CVE-2019-11190...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-61.1.28 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov Orabug: 25598257 CVE-2017-6074...

qemu-kvm security update

1.5.3-160.el76.3 - kvm-slirp-check-sscanf-result-when-emulating-ident.patch bz1669067 - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch bz1669067 - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch bz1669067 - kvm-slirp-don-t-manipulate-sorcv-in-tcpemu.patch bz1669067 ...

jquery-ui security update

1.10.4.custom-4.0.1 - Backport jQuery CVE-2020-11022 and CVE-2020-11023 fixes to bundled jQuery v1.10.2 Orabug: 33869588 1.10.4.custom-4 - removed %%defattr from specfile - removed Group from specfile - removed BuildRoot from specfiles Tue May 10 2016 Grant Gainey 1.10.4.custom-3 - jquery-ui: bui...

httpd:2.4 security update

httpd 2.4.37-43.0.2.2 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-43.2 - Resolves: 2059256 - CVE-2021-34798 httpd:2.4/httpd: NULL pointer dereference via malformed requests - Resolves: 2059257 - CVE-2021-39275...