java-1.8.0-openjdk security update

1:1.8.0.232.b09-0 - Update to aarch64-shenandoah-jdk8u232-b09. - Switch to GA mode for final release. - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream. - Resolves: rhbz1753423 1:1.8.0.232.b08-0.0.ea - Update to aarch64-shenandoah-jdk8u232-b08. - Resolves: rhbz1753423...

Unbreakable Enterprise kernel security update

4.1.12-124.27.1 - scsi: libfc: sanitize EDTOV and RATOV setting Hannes Reinecke Orabug: 25933179 - scsi: libfc: use configured rport EDTOV Hannes Reinecke Orabug: 25933179 - scsi: libfc: additional debugging messages Hannes Reinecke Orabug: 25933179 - scsi: libfc: don't advance state machine for...

Unbreakable Enterprise kernel security update

4.1.12-112.14.13 - Revert 'kernel.spec: Require the new microcodectl.' Brian Maly 4.1.12-112.14.12 - xen-blkback: add pendingreq allocation stats Ankur Arora Orabug: 27386890 - xen-blkback: move indirect req allocation out-of-line Ankur Arora Orabug: 27386890 - xen-blkback: pull nseg validation o...

ntp security update

4.2.6p5-22.0.1.el72.2 - add disable monitor to default ntp.conf CVE-2013-5211...

go-toolset:ol8 security and bug fix update

go-toolset 1.11.13-1 - Bump version to 1.11.13 - Related: rhbz1743204 - Related: rhbz1743206 golang 1.11.13-2 - Improve error message when using non-FIPS API in FIPS mode. - Fixes CVE-2019-9512. - Fixes CVE-2019-9514. - Resolves: rhbz1745711 - Resolves: rhbz1745705 1.11.6-3 - Updates to be less...

libtiff security update

4.4.0-7 - Fix CVE-2022-3970 - Resolves: CVE-2022-3970 4.4.0-6 - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598 CVE-2022-3627 - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598 CVE-2022-3627...

libreoffice security update

6.4.7.2-11.0.1 - Replace colors with Oracle colors Orabug: 32120093 - Build with --with-vendor=Oracle America, Inc. - Added the --with-hamcrest option to configure. 1:6.4.7.2-11 - Resolves: rhbz2060559 CVE-2021-25636...

Unbreakable Enterprise kernel security update

4.14.35-2047.515.3 - uek-rpm: Enable Pensando EMMC reset controller Thomas Tai Orabug: 34325721 - mfd: pensandoelbasr: Add Pensando Elba System Resource Chip Brad Larson Orabug: 34325721 - dsc-drivers: update drivers for 1.15.9-C-65 Shannon Nelson Orabug: 34325721 4.14.35-2047.515.2 - net/rds:...

GNOME security, bug fix, and enhancement update

accountsservice 0.6.55-2 - Add support for user templates so user can specify default session Resolves: 1812788 gdm 40.0-14 - Fix XDMCP Resolves: 2004170 - Fix crash at shutdown Related: 2004170 40.0-13 - Disable Wayland on HyperV - Fix Xorg fallback Related: 1998989 40.0-12 - Redisable on server...

Unbreakable Enterprise kernel security update

4.1.12-61.63.1 - Revert 'kernel.spec: Require the new microcodectl.' Brian Maly - x86: Clean up IBRS functionality resident in common code Kanth Ghatraju Orabug: 27439198 - x86: Display correct settings for the SPECTREV2 bug Kanth Ghatraju Orabug: 27439198 - Set CONFIGGENERICCPUVULNERABILITIES fl...

kernel security update

2.6.32-696.18.7.OL6 - Update genkey bug 25599697 2.6.32-696.18.7 - x86 specctrl: svm: specctrl at vmexit needs per-cpu areas functional Waiman Long 1519797 1519796 CVE-2017-5715 - x86 specctrl: Eliminate redundnat FEATURE Not Present messages Waiman Long 1519797 1519796 CVE-2017-5715 - x86...

ntp security update

4.2.6p5-12.0.1.el69.1 - add disable monitor to default ntp.conf CVE-2013-5211 4.2.6p5-12.el69.1 - fix buffer overflow in datum refclock driver CVE-2017-6462 - fix crash with invalid unpeer command CVE-2017-6463 - fix potential crash with invalid server command CVE-2017-6464 4.2.6p5-12 - don't lim...

freetype security update

2.10.4-10 - Fix for CVE-2025-27363 out-of-bound write vulnerability - Patch initially by Marc Deslauriers of Canonical - https://www.openwall.com/lists/oss-security/2025/03/14/3 - Adjusted for EL9 by Jonathan Wright of AlmaLinux - and a member of the Meta security team - Resolves: RHEL-83105...

zlib security update

1.2.11-32 - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c - Resolves: CVE-2022-37434...

Unbreakable Enterprise kernel security update

4.14.35-2047.511.5.2 - cgroup-v1: Require capabilities to set releaseagent Eric W. Biederman Orabug: 33876756 CVE-2022-0492 - scsi: libiscsi: Hold backlock when calling iscsicompletetask Gulam Mohamed Orabug: 33876755 4.14.35-2047.511.5.1 - arm64, mm, efi: Account for GICv3 LPI tables in static...

qemu security update

15:4.2.1-9.el7 - Revert 'oslib-posix: refactor memory prealloc threads' Mark Kanda Orabug: 32903662 - Revert 'oslib-posix: initialize backend memory objects in parallel' Mark Kanda Orabug: 32903662 15:4.2.1-8.el7 - i386/pc: let iterator handle regions below 4G Joao Martins 15:4.2.1-7.el7 -...

glibc security, bug fix, and enhancement update

2.28-151.0.1.el84 - merge RH patches for ol8-u4 release Review-exception: Patch merge - Provide glibc.pthread.mutexspincount tunable for pthread adaptive - spin mutex Orabug: 27982358. Reviewed-by: Qing Zhao - add Ampere emag to tunable cpu list Patrick McGehearty - add optimized memset for emag ...

wpa_supplicant security update

1:2.6-12.1.0.2 - Added undefine-bitwise-in-common-header.patch bug 27677154 1:2.6-12.1 - P2P: Fix a corner case in peer addition based on PD Request CVE-2021-27803...

nodejs:10 security update

nodejs 1:10.23.1-1 - January Security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Rebase to 10.23.1 - Resolves: RHBZ1916461, RHBZ1914789 - Resolves: RHBZ1914783, RHBZ1916462, RHBZ1916395, RHBZ1916459 - Resolves: RHBZ1916691, RHBZ1916689, RHBZ1916388 - Remo...

freerdp and vinagre security, bug fix, and enhancement update

freerdp 2:2.1.1-1 - Update to 2.1.1 rhbz1834287. 2:2.0.0-47.rc4 - Fix SCARDINSUFFICIENTBUFFER error rhbz1803054 - Do not advertise /usb in help output rhbz1761144 vinagre 3.22.0-23 - Remove unused variable CovScan - Related: 1839744 3.22.0-22 - Rebuild due to new version of FreeRDP - Fix an issue...

kernel security and bug fix update

2.6.32-754.24.2.OL6 - Update genkey bug 25599697 2.6.32-754.24.2 - documentation Documentation: Add ITLBMULTIHIT documentation Paolo Bonzini 1692385 CVE-2018-12207 - kvm KVM: introduce nohugepages module parameter Paolo Bonzini 1692385 CVE-2018-12207 - x86 x86: Add ITLBMULTIHIT bug infrastructure...

edk2 security update

1:1.2-5.el7 - Update spec file to remove 'modprobe kvm-intel' and remove --enable-kvm arg to ovmfvarsgenerator so qemu will not require kvm kernel module. Aaron Young - Update spec file to modprobe kvmintel module prior to running qemu to enroll default keys. Aaron Young - Enroll Oracle cert/key...

vim security update

2:7.4.629-5.2 - 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline - fix spec warnings about expanding macros...

Unbreakable Enterprise kernel security update

4.1.12-124.26.7 - ibcore: initialize shpd field when allocating 'struct ibpd' Mukesh Kacker Orabug: 29384815 - Revert 'x86/apic: Make archsetuphwirq NUMA node aware' Brian Maly Orabug: 29542185 - qlcnic: fix Tx descriptor corruption on 82xx devices Shahed Shaikh Orabug: 27708787 - block: Fix a ra...

NetworkManager security update

1:1.12.0-8 - dhcp: fix out-of-bounds heap write for DHCPv6 with internal plugin CVE-2018-15688...

glibc security update

2.28-164.0.5.3 - Merge external errata patches. - Siddhesh Poyarekar - 2.28-164.3 - CVE-2021-3999: getcwd: align stack on clone in aarch64 and fix a memory leak 2032280 - Siddhesh Poyarekar - 2.28-164.2 - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clntcreate for 'unix' and...

glibc security update

2.28-164.0.1 - Merge of RH patches for ol8-u5 beta release Review-exception: Routine merge - Provide glibc.pthread.mutexspincount tunable for pthread adaptive - spin mutex Orabug: 27982358. Reviewed-by: Qing Zhao - add Ampere emag to tunable cpu list Patrick McGehearty - add optimized memset for...

Unbreakable Enterprise kernel security update

4.1.12-124.39.5 - Input: ff-memless - kill timer in destroy Oliver Neukum Orabug: 31213691 CVE-2019-19524 - libertas: Fix two buffer overflows at parsing bss descriptor Wen Huang Orabug: 31351307 CVE-2019-14896 CVE-2019-14897 CVE-2019-14897 - binfmtelf: use ELFETDYNBASE only for PIE Kees Cook...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.31.1 - alarmtimer: Prevent overflow for relative nanosleep Thomas Gleixner Orabug: 29269167 CVE-2018-13053 - KEYS: Don't permit requestkey to construct a new keyring David Howells Orabug: 29304552 CVE-2017-17807 - KEYS: add missing permission check for requestkey destination...

kernel security and bug fix update

kernel - 2.6.18-417.0.0.0.1 - netfront fix ring buffer index go back led vif stop orabug 18272251 - net fix tcptrimhead James Li orabug 14512145, 19219078 - ocfs2: dlm: fix recovery hung Junxiao Bi orabug 13956772 - i386: fix MTRR code Zhenzhong Duan orabug 15862649 - oprofile x86, mm: Add...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-61.1.6 - blk-mq: avoid setting hctx-tags-cpumask before allocation Akinobu Mita Orabug: 24464170 4.1.12-61.1.3 - ocfs2: improve recovery performance Junxiao Bi Orabug: 24395729 - qed: Utilize FW 8.10.3.0 Yuval Mintz Orabug: 24442553 - blk-mq: mark request queue as mq asap Ming L...

java-21-openjdk security update

1:21.0.7.0.6-1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.7.0.6-1 - Update to jdk-21.0.7+6 GA - Update release notes to 21.0.7+6 - Rebase FIPS support against 21.0.7+5 - Require tzdata 2025a due to upstream inclusion of JDK-8347965 - Sync the copy of the portable specfile with the...

freetype security update

2.9.1-10 - Fix CVE-2025-27363 Out-of-bounds Write - Resolves: RHEL-83094...

kernel security update

4.18.0-513.18.1.el89.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

sudo security update

1.9.5p2-7.1 RHEL 9.1.0.Z ERRATUM - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user Resolves: rhbz2161224...

httpd:2.4 security update

httpd 2.4.37-47.0.2.2 - modproxy: approxyhttprequest to clear hop-by-hop first and...

mariadb:10.3 security and bug fix update

galera 25.3.34-4 - Explicitly require the 'procps-ng' package - Otherwise it will not require it in the lightweight systems e.g. containers - and Galera won't work properly 25.3.34-3 - Use downstream garbd-wrapper and garbd.service to ensure compatibility - Add upstream versions of garbd-wrapper...

redis:6 security update

6.0.9-3 - fix integer overflow via STRALGO LCS command CVE-2021-29477...

nodejs:12 security update

nodejs 1:12.20.1-1 - Security rebase for January security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Resolves: RHBZ1916460, RHBZ1914786 - Resolves: RHBZ1914784, RHBZ1916396 nodejs-nodemon 2.0.3-1 - Resolves: RHBZ1921841, RHBZ1921843, RHBZ1921842 - Rebase ...

java-1.8.0-openjdk security update

1:1.8.0.232.b09-0 - Update to aarch64-shenandoah-jdk8u232-b09. - Switch to GA mode for final release. - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream. - Resolves: rhbz1753423 1:1.8.0.232.b08-0.0.ea - Update to aarch64-shenandoah-jdk8u232-b08. - Resolves: rhbz1753423...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.39.1 - tcp: purge write queue in tcpconnectinit Eric Dumazet Orabug: 30240134 CVE-2019-15239 - cx24116: fix a buffer overflow when checking userspace params Mauro Carvalho Chehab Orabug: 30254282 CVE-2015-9289 - floppy: fix out-of-bounds read in copybuffer Denis Efremov...

kernel security and bug fix update

3.10.0-1062.1.1 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 3.10.0-1062.1.1 - fs nfsv4.1: Avoid false retries when RPC calls are interrupted Benjam...

kdelibs and kde-settings security and bug fix update

kdelibs 6:4.14.8-11 - KConfig: malicious .desktop files would execute code Resolves: bz1740736 kde-settings 19-23.10.0.1 - Change GreetString bug 11710280 19-23.10 - Use correct tcsh syntax for config scripts Resolves: bz1738491...

firefox security update

60.6.1-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 60.6.1-1 - Update to 60.6.1 ESR Build 1...

glibc security update

2.17-222 - Restore internal GLIBCPRIVATE symbols for use during upgrades 1523119 2.17-221 - CVE-2018-1000001: Fix realpath buffer underflow 1534635 - i386: Fix unwinding for 32-bit C++ application 1529982 - Reduce thread and dynamic loader stack usage 1527904 - x86-64: Use XSAVE/XSAVEC more often...

mariadb security and bug fix update

1:5.5.56-2 - Do not fix context and change owner if run by root in mariadb-prepare-db-dir Related: 1458940 - Check properly that datadir includes only expected files Related: 1356897 1:5.5.56-1 - Rebase to 5.5.56 That release also fixes the following security issues: CVE-2016-5617/CVE-2016-6664...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.6.2 - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. David Howells Orabug: 23279020 CVE-2016-0758 - net: add validation for the socket syscall protocol argument Hannes Frederic Sowa Orabug: 23267997 CVE-2015-8543 CVE-2015-8543 - ipv6: addrconf:...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.3.2 - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection Andy Lutomirski Orabug: 22742507 CVE-2015-5157 - x86/nmi/64: Reorder nested NMI checks Andy Lutomirski Orabug: 22742507 CVE-2015-5157 - x86/nmi/64: Improve nested NMI comments Andy Lutomirski...

.NET Core 3.1 security and bugfix update

3.1.423-1.0.1 - Add missing Oracle Linux Runtime IDs 3.1.423-1 - Update to .NET SDK 3.1.423 and Runtime 3.1.29 - Resolves: RHBZ2123785...

Unbreakable Enterprise kernel security update

4.1.12-124.45.6 - qla2xxx: disable target reset during link reset and update version Quinn Tran Orabug: 32095664 - scsi: qla2xxx: Fix early srb free on abort Quinn Tran Orabug: 32095664 - scsi: qla2xxx: Fix comment in MODULEPARMDESC in qla2xxx Masanari Iida Orabug: 32095664 - scsi: qla2xxx: Enabl...