virt:kvm_utils2 security update

qemu-kvm 6.1.1-5-el8 - hw/pvrdma: Protect against buggy or malicious guest driver Yuval Shaia Orabug: 35064352 CVE-2022-1050 - hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion Philippe Mathieu-Daude Orabug: 35060182 - hw/display/qxl: Avoid buffer overrun in qxlphys2virt...

Unbreakable Enterprise kernel security update

4.1.12-124.66.3 - fuse: fix pipe buffer lifetime for directio Miklos Szeredi Orabug: 33981149 CVE-2022-1011 - vt: drop old FONT ioctls Jiri Slaby Orabug: 34408794 CVE-2021-33656 - video: ofdisplaytiming.h: include errno.h Hsin-Yi Wang Orabug: 34408910 CVE-2021-33655 - fbcon: Disallow setting font...

virt:kvm_utils security update

libvirt 5.7.0-34.el8 - qemu: blockcopy: Allow late opening of the backing chain of a shallow copy Peter Krempa Orabug: 33091019 - qemu: capabilities: Introduce QEMUCAPSBLOCKDEVSNAPSHOTALLOWWRITEONLY Peter Krempa Orabug: 33091019 - qemuDomainBlockCopyCommon: Record updated flags to block job Peter...

kernel security, bug fix, and enhancement update

4.18.0-372.16.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

Unbreakable Enterprise kernel security update

4.14.35-2047.511.5.8.el7uek - netfilter: nftables: initialize registers in nftdochain Pablo Neira Ayuso Orabug: 34048826 CVE-2022-1016...

nss security update

3.67.0-7 - Fix CVE 2021 43527...

nodejs:14 security and bug fix update

nodejs 1:14.17.5-1 - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940, - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672 - Resolves RHBZ1847529 make FIPS always available - Resolves: RHBZ1988599, RHBZ1994000, RHBZ1993998, RHBZ1993095 - Resolves: RHBZ1994028,...

olcne security update

olcne 1.2.4-5 - Updated registry-image-helper.sh to work with olcne-utils 1.2.4-4 - Fix istio template for 1.9.6 for k8s update failure 1.2.4-3 - Fixed yaml file to stop olcne-nginx and keepalived services at uninstall Orabug: 32296282 1.2.4-2 - Fix iptables issue when running on OL7 host using O...

containerd security update

containerd 1.4.8-1 - Address CVE-2021-32760 docker-cli 19.03.11-13 - updated containerd minimum version to 1.4.8 to address CVE-2021-32760. docker-engine 19.03.11-13 - updated containerd minimum version to 1.4.8 to address CVE-2021-32760...

go-toolset:ol8 security, bug fix, and enhancement update

delve 1.5.0-2.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.5.0-2 - Add golang-1.15.4 related patch - Resolves: rhbz1901189 1.5.0-1 - Rebase to 1.5.0 - Related: rhbz1870531 golang 1.15.7-1 - Rebase to 1.15.7 - Resolves: rhbz1870531 - Resolves: rhbz1919261 1.15.5-1 - Rebase to...

thunderbird security update

78.9.1-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.9.1-1 - Update to 78.9.1...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.53.1 - Fonts: Support FONTEXTRAWORDS macros for built-in fonts Peilin Ye Orabug: 32176267 - fbdev, newportcon: Move FONTEXTRAWORDS macros into linux/font.h Peilin Ye Orabug: 32176267 CVE-2020-28915 - vt: Disable KDFONTOPCOPY Daniel Vetter Orabug: 32187751 CVE-2020-28974...

kernel security and bug fix update

3.10.0-1160.11.1.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 slotsret under spinlockirq protection Rafael...

edk2 security update

1:1.3.2-1.el7 - Updates for OVMF/AAVMF Version 1.3.2 including: Fri Jul 31 2020 Aaron Young - Create new 1.3.2 release for OL7 Fri May 01 2020 Aaron Young - Create new 1.3.1 release for OL7 Wed Feb 05 2020 Aaron Young - Create new 1.3 release for OL7 which includes the following fixed CVEs:...

kernel security and bug fix update

2.6.32-754.31.1.OL6 - Update genkey bug 25599697 2.6.32-754.31.1 - x86 x86/speculation: Provide SRBDS late microcode loading support Waiman Long 1827185 CVE-2020-0543 - documentation x86/speculation: Add Ivy Bridge to affected list Waiman Long 1827185 CVE-2020-0543 - documentation x86/speculation...

Unbreakable Enterprise kernel security update

2.6.39-400.324.1 - media: ttusb-dec: Fix info-leak in ttusbdecsendcommand Tomas Bortoli Orabug: 31351122 CVE-2019-19533 - ALSA: core: Fix card races between register and disconnect Takashi Iwai Orabug: 31351895 CVE-2019-15214...

Unbreakable Enterprise kernel security update

5.4.17-2011.3.2.1uek - x86/speculation: Add Ivy Bridge to affected list Josh Poimboeuf Orabug: 31352779 CVE-2020-0543 - x86/speculation: Add SRBDS vulnerability and mitigation documentation Mark Gross Orabug: 31352779 CVE-2020-0543 - x86/speculation: Add Special Register Buffer Data Sampling SRBD...

freerdp security update

2.0.0-4.rc4.1 - CVE-2020-13398: Fix out-of-bounds write in crypto.c 1841974...

telnet security update

1:0.17-73.1 - Resolves: 1814473 - Arbitrary remote code execution in utility.c via short writes or urgent data...

kernel security, bug fix, and enhancement update

3.10.0-1127.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 3.10.0-1127 - fs flexfiles: Dont tie up all the rpciod threads in resends Benjamin...

python-imaging security update

1.1.6-20 - Fixes for CVE-2020-5312 and related part of CVE-2019-16865 Resolves: rhbz1789533...

icu security update

4.2.1-15 - Apply icu.13634.integer.overflow.patch - Apply icu.20958.segv.mapper.patch - Resolves: rhbz1809876...

java-11-openjdk security update

1:11.0.5.10-0.0.1 - link atomic for ix86 build 1:11.0.5.10-0 - Update to shenandoah-jdk-11.0.5+10 GA - Switch to GA mode for final release. - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream. - Resolves: rhbz1753423 1:11.0.5.9-0.0.ea - Update to shenandoah-jdk-11.0.5+9 EA -...

elfutils security, bug fix, and enhancement update

0.176-2 - Add elfutils-0.176-xlate-note.patch 1704754 0.176-1 - New upstream release 1676504 CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150, CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402, CVE-2018-16403, CVE-2018-18310, CVE-2018-18521, CVE-2018-18520...

python27:2.7 security update

Cython 0.28.1-7 - Bumping due to problems with modular RPM upgrade path 1695587 - Related: rhbz1693974 PyYAML 3.12-16 - Bumping due to problems with modular RPM upgrade path 1695587 - Related: rhbz1693974 babel 2.5.1-9 - Bumping due to problems with modular RPM upgrade path 1695587 - Related:...

python3 security update

3.6.8-2.0.1 - Add Oracle Linux distribution in platform.py Orabug: 20812544 3.6.8-2 - Security fix for CVE-2019-9636 rhbz1693973...

libvirt security update

0.10.2-64.0.1 - Replace docs/et.png in tarball with blank image 0.10.2-64.el610.1 - cpux86: Do not cache microcode version CVE-2018-12126, CVE-2018-12130, CVE-2018-12127 - cpumap: Define md-clear CPUID bit CVE-2018-12126, CVE-2018-12130, CVE-2018-12127...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.22.1 - dm: fix race between dmgetfromkobject and dmdestroy Hou Tao CVE-2017-18203 - drm: udl: Properly check framebuffer mmap offsets Greg Kroah-Hartman Orabug: 27986407 CVE-2018-8781 - kernel/exit.c: avoid undefined behaviour when calling wait4 wait4-2147483648, 0x20, 0,...

python security update

2.7.5-69.0.1 - Add Oracle Linux distribution in platform.py orabug 20812544 2.7.5-70 - Remove 3DS cipher to mitigate CVE-2016-2183 sweet32. Resolves: rhbz1584545...

qemu-kvm security update

1.5.3-156.el75.3 - kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch bz1584363 - kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch bz1584363 - Resolves: bz1584363 CVE-2018-3639 qemu-kvm: hw: cpu: AMD: speculative store bypass rhel-7.5.z...

kernel security, bug fix, and enhancement update

...

Unbreakable Enterprise kernel security update

2.6.39-400.297.5 - selinux: quiet the filesystem labeling behavior message Paul Moore Orabug: 25721485 - RDS/IB: active bonding port state fix for intfs added late Mukesh Kacker Orabug: 25875426 - HID: hid-cypress: validate length of report Greg Kroah-Hartman Orabug: 25891914 CVE-2017-7273 - udf:...

samba4 security update

4.2.10-10 - resolves: 1450779 - Security fix for CVE-2017-7494...

tomcat security update

0:7.0.69-11 - Resolves: rhbz1413591 CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing - Resolves: rhbz1402662 CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests...

Unbreakable Enterprise kernel security update

2.6.39-400.294.3 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov Orabug: 25598277 CVE-2017-6074...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-61.1.22 - ocfs2: fix trans extend while free cached blocks Junxiao Bi Orabug: 25136991 - ocfs2: fix trans extend while flush truncate log Junxiao Bi Orabug: 25136991 - ocfs2: extend enough credits for freeing one truncate record while replaying truncate records Xue jiufei Orabug...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-61.1.16 - mm: remove gupflags FOLLWRITE games from getuserpages Linus Torvalds Orabug: 24927306 CVE-2016-5195 4.1.12-61.1.15 - drivers/nvme: provide a module parameter for setting number of I/O queues Shan Hai Orabug: 24914956 - blk-mq: improve warning for running a queue on the...

Unbreakable Enterprise kernel security update

2.6.39-400.283.2 - KEYS: potential uninitialized variable Dan Carpenter Orabug: 24393863 CVE-2016-4470...

Unbreakable Enterprise kernel security update

2.6.39-400.278.3 - net: add validation for the socket syscall protocol argument Hannes Frederic Sowa Orabug: 23267976 CVE-2015-8543 CVE-2015-8543 - ipv6: addrconf: validate new MTU before applying it Marcelo Leitner Orabug: 23263251 CVE-2015-8215 - ext4: avoid hang when mounting non-journal...

openssl security update

1.0.1e-51.5 - fix CVE-2016-2105 - possible overflow in base64 encoding - fix CVE-2016-2106 - possible overflow in EVPEncryptUpdate - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC - fix CVE-2016-2108 - memory corruption in ASN.1 encoder - fix CVE-2016-2109 - possible DoS when readi...

krb5 security, bug fix, and enhancement update

1.13.2-9 - Add patch and test case for 'KDC does not return proper client principal for client referrals' - Resolves: 1259846 1.13.2-9 - Ammend patch for RedHat bug 1252454 'testsuite complains 'Lifetime has increased by 32436 sec while 0 sec passed!', while rhel5-libkrb5 passes' to handle the...

sssd security and bug fix update

1.12.4-47.4 - Resolves: rhbz1268783 - Memory leak / possible DoS with krb auth. 1.12.4-47.3 - Resolves: rhbz1268784 - SSSD POSIX attribute check is too strict 1.12.4-47.2 - Resolves: rhbz1264098 - cleanupgroups should sanitize dn of groups 1.12.4-47.1 - Resolves: rhbz1258398 - sysdb sudo search...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-68.3.5 - KVM: x86: SYSENTER emulation is broken Nadav Amit Orabug: 21502739 CVE-2015-0239 CVE-2015-0239 - fs: take imutex during preparebinprm for setugid executables Jann Horn Orabug: 21502254 CVE-2015-3339 - eCryptfs: Remove buggy and unnecessary write in file name decode...

Unbreakable Enterprise kernel security update

kernel-uek 2.6.32-400.37.7 - ipv6: Don't reduce hop limit for an interface D.S. Ljungmark Orabug: 21444792 CVE-2015-2922...

kernel security and bug fix update

3.10.0-229.4.2 - Oracle Linux certificates Alexey Petrenko 3.10.0-229.4.2 - x86 crypto: aesni - fix memory usage in GCM decryption Kurt Stutsman 1213331 1212178 CVE-2015-3331 3.10.0-229.4.1 - crypto x86: sha256ssse3 - also test for BMI2 Herbert Xu 1211484 1201563 - crypto testmgr: fix RNG return...

openssl security update

0.9.8e-33 - fix CVE-2014-8275 without introduction of CVE-2015-0286 - various certificate fingerprint issues - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export ciphersuites and on server - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption - fix...

Unbreakable Enterprise kernel security update

2.6.39-400.249.3 - IB/core: Prevent integer overflow in ibumemget address arithmetic Shachar Raindel Orabug: 20788393 CVE-2014-8159 CVE-2014-8159 2.6.39-400.249.2 - xen-pciback: limit guest control of command register Jan Beulich Orabug: 20704156 CVE-2015-2150 CVE-2015-2150 - net: sctp: fix slab...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-44.1.3.el7uek - ALSA: control: Don't access controls outside of protected regions Lars-Peter Clausen Orabug: 19817785 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 - ALSA: control: Fix replacing user controls Lars-Peter Clausen Orabug: 19817747 CVE-2014-4653 CVE-2014-4654...

xerces-j2 security update

2.11.0-17 - Fix XML parsing bug JAXP, 8017298 - Resolves: CVE-2013-4002...

kernel security, bug fix, and enhancement update

2.6.32-431.23.3 - netdrv pppol2tp: fail when socket option level is not SOLPPPOL2TP 1119461 1119462 CVE-2014-4943 2.6.32-431.23.2 - kernel utrace: force IRET path after utracefinishvfork Oleg Nesterov 1115932 1115933 CVE-2014-4699 2.6.32-431.23.1 - net iptunnel: fix iptunnelfind to return NULL in...