kernel security and bug fix update

2.6.9-78.0.22.0.1.EL - xen fix for hung JVM thread after GPF orabug 7916406 Chuck Anderson - fix entropy flag in bnx2 driver to generate entropy pool John Sobecki orabug 5931647 - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug 6845794 - fix enomem due to larger mt...

bind security update

bind: 9.3.4-6.0.1.P1 - CVE-2008-1447 selinux-policy: 2.4.6-137.1 - Allow named to bind to any udp port Resolves: 451971...

ghostscript security update

9.27-16 - RHEL-18396 CVE-2023-46751 ghostscript: dangling pointer in gdevprnopenprinterseekable - RHEL-67046 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-15067 CVE-2020-27792 ghostscript: heap buffer over write vulnerability in GhostScript...

openssl security update

1:1.1.1k-14 - Backport fix SSLselectnext proto from OpenSSL 3.2 Fix CVE-2024-5535 Resolves: RHEL-45654...

bind9.16 security update

32:9.16.23-0.16.2 - Prevent crashing at masterformat system test CVE-2023-6516 32:9.16.23-0.16.1 - Prevent increased CPU load on large DNS messages CVE-2023-4408 - Prevent assertion failure when nxdomain-redirect is used with RFC 1918 reverse zones CVE-2023-5517 - Prevent assertion failure if DNS...

Unbreakable Enterprise kernel security update

5.4.17-2136.330.7.1 - KVM: x86: Add BHINO Daniel Sneddon Orabug: 36384803 CVE-2024-2201 - x86/bhi: Mitigate KVM by default Pawan Gupta Orabug: 36384803 CVE-2024-2201 - x86/bhi: Add BHI mitigation knob Pawan Gupta Orabug: 36384803 CVE-2024-2201 - x86/bhi: Enumerate Branch History Injection BHI bug...

Unbreakable Enterprise kernel security update

5.4.17-2136.329.3.2 - netfilter: nftables: reject QUEUE/DROP verdict parameters Florian Westphal Orabug: 36465920 CVE-2024-1086...

unbound security update

1.16.2-3.1 - Fix DNSSEC validation vulnerabilities which can lead to DoS in trivially orchestrated attacks CVE-2023-50387 and CVE-2023-50868...

tigervnc security update

1.13.1-2.7 - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice Resolves: RHEL-20388 - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent Resolves: RHEL-20382 - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching ...

edk2 security update

20230821 - Create new 20230821 release for OL8 which includes the following fixed CVEs: CVE-2019-14560 - Update to OpenSSL 1.1.1v which includes the following fixed CVEs: CVE-2023-3817 CVE-2023-3446 CVE-2023-2650 CVE-2023-0465 CVE-2023-0466 CVE-2023-0464 CVE-2023-0286 CVE-2023-0215 CVE-2022-4450...

qemu-kvm security, bug fix, and enhancement update

8.0.0-16.el93 - kvm-migration-Add-migration-prefix-to-functions-in-targe.patch bz2229868 - kvm-migration-Move-more-initializations-to-migrateinit.patch bz2229868 - kvm-migration-Add-.saveprepare-handler-to-struct-SaveVM.patch bz2229868 -...

python3.9 security update

3.9.18-1 - Update to 3.9.18 - Security fix for CVE-2023-40217 Resolves: RHEL-3043 3.9.17-2 - Fix symlink handling in the fix for CVE-2023-24329 Resolves: rhbz263261 3.9.17-1 - Update to 3.9.17 - Security fix for CVE-2023-24329 Resolves: rhbz2173917 3.9.16-2 - Add filters for tarfile extraction...

grafana security and enhancement update

9.2.10-7 - bump release number for rebuild with fixed gating.yaml file 9.2.10-6 - resolve RHEL-12665 - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work - testing is turned off due to test failures caused by testing date mismatch 9.2.10-5 - resolve CVE-2023-3128...

go-toolset:ol8 security update

delve golang 1.19.13-1 - Rebase to Go 1.19.13 CVE-2023-39325 CVE-2023-44487 go-toolset 1.19.13-1 - Rebase to Go 1.19.13 CVE-2023-39325 CVE-2023-44487...

unbound security and bug fix update

1.16.2-5 - Stop creating wrong devel manual pages 2135322 1.16.2-4 - Apply correctly previous change CVE-2022-3204 1.16.2-3 - Fix NRDelegation attack leading to uncontrolled resource consumption CVE-2022-3204...

xorg-x11-server security and bug fix update

1.20.11-15 - Rebuild for the missing debuginfo Related: rhbz2169522 1.20.11-14 - Fix xvfb-run script with --listen-tcp Resolves: rhbz2169522 1.20.11-13 - Fix CVE-2023-0494 2166977 1.20.11-12 - Follow-up fix for CVE-2022-46340 2151774 1.20.11-11 - CVE fix for: CVE-2022-4283 2151799, CVE-2022-46340...

Unbreakable Enterprise kernel security update

5.4.17-2136.318.7.1 - KVM: arm64: Disabling disabled PMU counters wastes a lot of time Alexandre Chartre Orabug: 33312587 - KVM: arm64: Don't zero the cycle count register when PMCREL0.P is set Alexandru Elisei Orabug: 33312587 - KVM: arm64: pmu: Only handle supported event counters Eric Auger...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.316.7 - runtime revert of virtionet: Stripe queue affinities across cores. Konrad Rzeszutek Wilk Orabug: 35001045 5.4.17-2136.316.6 - block: Change the granularity of io ticks from ms to ns Gulam Mohamed Orabug: 34780807 - powercap: intelrapl: support new layout of Psys PowerLimit...

olcne security update

1.4.5-1 - Address qemu CVE-2022-26353, CVE-2021-3748...

webkit2gtk3 security, bug fix, and enhancement update

2.34.6-1 - Update to 2.34.6 Related: 1985042 2.34.5-1 - Update to 2.34.5 - Related: 1985042 2.34.4-1 - Update to 2.34.4 - Resolves: 1985042 2.32.4-1 - Update to 2.32.4 - Related: 1985042 - Resolves: 2006429...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.306.1.3 - KVM: x86/mmu: do compare-and-exchange of gPTE via the user address Paolo Bonzini Orabug: 34053807 CVE-2022-1158 5.4.17-2136.306.1.2 - Revert 'rds/ib: recover rds connection from stuck rx path' Rohit Nair Orabug: 34045203 5.4.17-2136.306.1.1 - netfilter: nftables: initialize...

openssl security update

1:1.0.2k-25 - Fixes CVE-2022-2078 Infinite loop in BNmodsqrt reachable when parsing certificates - Related: rhbz2067160...

openssl security update

1:1.1.1k-5.0.1 - fix CVE-2022-0778 - possible infinite loop in BNmodsqrt Orabug: 33974871...

ruby:2.6 security update

ruby 2.6.9-108 - Upgrade to Ruby 2.6.9. - Skip JIT tests in RHEL 8. - Fix the issues required to start the 'make test-bundler' itself. - Fix Bundler dependency confusion. Resolves: CVE-2020-36327...

nodejs:14 security, bug fix, and enhancement update

nodejs 1:14.18.2-2 - Add missing fixes - Resolves: RHBZ2027642, RHBZ2027635 1:14.18.2-1 - Resolves: RHBZ2027609 - Resolves: RHBZ2027649, RHBZ2027646, RHBZ2027642, RHBZ2027635 - Rebase to new version to fix CVEs...

kernel security and bug fix update

3.10.0-1160.49.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.9 - Update oraclekernel-sig-key...

php:7.4 security, bug fix, and enhancement update

libzip php 7.4.19-1 - rebase to 7.4.19 1944110...

python39:3.9 and python39-devel:3.9 security update

modwsgi 4.7.1-4 - Convert from Fedora to the python39 module in RHEL8 - Resolves: rhbz1877430 4.7.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora33MassRebuild 4.7.1-2 - Rebuilt for Python 3.9 4.7.1-1 - update to 4.7.1 1721376 numpy 1.19.4-3 - Adjusted the postun scriptlets to enable...

java-11-openjdk security update

1:11.0.12.0.7-0 - Update to jdk-11.0.12.0+7 - Update release notes to 11.0.12.0+7 - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz1972395 1:11.0.12.0.6-0.0.ea - Update to jdk-11.0.12.0+6 - Update release notes to 11.0.12.0+6 - Switch t...

postgresql security update

9.2.24-7 - Fix CVE-2021-32027 - Resolves: 1964507...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.501.2.el7 - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32634994 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE Chris Leech Orabug: 32634994 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi...

bind security update

32:9.11.20-5.1 - Fix off-by-one bug in ISC SPNEGO implementation CVE-2020-8625...

grub2 security update

2.02-0.87.0.7 - Fix CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233 Orabug: 32530657 - Fix various coverity issues Orabug: 32530657 - Add SBAT metadata to grubx64.efi Orabug: 32530657 2.02-0.87.0.5 - Use similar format for menu entry in gru...

kernel security and bug fix update

3.10.0-1160.11.1.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 slotsret under spinlockirq protection Rafael...

oniguruma security update

6.8.2-2 - Fix CVE-2019-13225 Resolves: 1771052...

python38:3.8 security, bug fix, and enhancement update

...

python3 security update

3.6.8-17.0.1 - Add Oracle Linux distribution in platform.py Orabug: 20812544 3.6.8-17 - Overhaul pythons FIPS mode support Resolves: rhbz1788459 3.6.8-16 - Security fix for CVE-2020-8492 Resolves: rhbz1810616 3.6.8-15 - Security fix for CVE-2019-16935 Resolves: rhbz1797999 3.6.8-14 - Provide and...

webkitgtk4 security, bug fix, and enhancement update

2.28.2-2 - Resolves: rhbz1817144 Rebuild to support ppc and s390 2.28.2-1 - Resolves: rhbz1817144 Rebase to 2.28.2...

bind security update

32:9.11.13-5 - Limit number of queries triggered by a request CVE-2020-8616 32:9.11.13-4 - Fix invalid tsig request CVE-2020-8617...

glibc security, bug fix, and enhancement update

2.28-101.0.1 - add Ampere emag to tunable cpu list Patrick McGehearty - add optimized memset for emag - add an ASIMD variant of strlen for falkor - Orabug: 2700101. - Modify glibc-ora28849085.patch so it works with RHCK kernels. - Orabug: 28849085. - Make IOfunlockfile match funlockfile and...

php security update

5.4.16-48 - fix underflow in envpathinfo in fpmmain.c CVE-2019-11043 5.4.16-47 - fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584 - fix out-of-bounds read in base64decodexmlrpc CVE-2019-9024 - fix reflected XSS in phar 404 page CVE-2018-5712 - fix reflected XSS in phar 403 and...

kernel security, bug fix, and enhancement update

3.10.0-1127.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 3.10.0-1127 - fs flexfiles: Dont tie up all the rpciod threads in resends Benjamin...

python-imaging security update

1.1.6-20 - Fixes for CVE-2020-5312 and related part of CVE-2019-16865 Resolves: rhbz1789533...

Unbreakable Enterprise kernel security update

4.1.12-124.36.4 - KVM: nVMX: Check IO instruction VM-exit conditions Oliver Upton Orabug: 30944739 CVE-2020-2732 - KVM: nVMX: Refactor IO bitmap checks into helper function Oliver Upton Orabug: 30944739 CVE-2020-2732 - KVM: nVMX: Don't emulate instructions in guest mode Paolo Bonzini Orabug:...

sudo security update

1.8.25p1-8 - RHEL-8.1.0 - fixed CVE-2019-14287 Resolves: rhbz1760696...

java-1.8.0-openjdk security update

1:1.8.0.201.b09-0 - Update to aarch64-shenandoah-jdk8u201-b09. - Resolves: rhbz1661577 1:1.8.0.192.b12-1 - Add 8160748 for AArch64 which is missing from upstream 8u version. - Add port of 8189170 to AArch64 which is missing from upstream 8u version. - Resolves: rhbz1661577 1:1.8.0.192.b12-0 -...

python security update

2.7.5-69.0.1 - Add Oracle Linux distribution in platform.py orabug 20812544 2.7.5-70 - Remove 3DS cipher to mitigate CVE-2016-2183 sweet32. Resolves: rhbz1584545...

openssh security, bug fix, and enhancement update

7.4p1-16 + 0.10.3-2 - Fix for CVE-2017-15906 1517226 7.4p1-15 + 0.10.3-2 - Do not hang if SSH AuthorizedKeysCommand output is too large 1496467 - Do not segfault pamsshagentauth if keyfile is missing 1494268 - Do not segfault in audit code during cleanup 1488083 - Add WinSCP 5.10+ compatibility...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.20.2 - x86: Add another set of MSR accessor functions Borislav Petkov Orabug: 27444923 CVE-2017-5753 - userns: prevent speculative execution Elena Reshetova Orabug: 27444923 CVE-2017-5753 - udf: prevent speculative execution Elena Reshetova Orabug: 27444923 CVE-2017-5753 - f...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.18.4 - net/packet: fix overflow in check for tpreserve Andrey Konovalov Orabug: 26143552 CVE-2017-7308 - net/packet: fix overflow in check for tpframenr Andrey Konovalov Orabug: 26143552 CVE-2017-7308 - net/packet: fix overflow in check for priv area size Andrey Konovalov...