kernel security, bug fix, and enhancement update

5.14.0-70.26.1.0.10.OL9 - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 5.14.0-70.26.10.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted...

kernel security, bug fix, and enhancement update

4.18.0-372.26.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

postgresql security update

9.2.24-8 - Resolves: CVE-2022-1552 - Backport upstrem fix: a117cebd638dd02e5c2e791c25e43745f233111b...

go-toolset:ol8addon security update

go-toolset 1.16.15-1 - Rebase to Go 1.16.15 golang 1.16.15-1.0.1 - Add patches from 1.16.12 to 1.16.15 - Add Sources for 3 binary files that changed between 1.16.12 and 1.16.15 - Rename basevrsn to baseversion - Reviewed-by: XXX XXX...

go-toolset:ol8addon security update

go-toolset 1.17.10-1 - Set version to correspond to the matching build golang version - delve can be now added to aarch64 as well, remove ifarch. golang 1.17.10-1.0.1 - Add patches between Go 1.17.7 and Go 1.17.10 - Rename baseversn to baseversion - Remove unneeded patches from previous version -...

thunderbird security update

91.6.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 91.6.0-1 - Update to 91.6.0 build1...

Unbreakable Enterprise kernel security update

4.1.12-124.59.1.2 - fix regression in 'epoll: Keep a reference on files added to the check list' Al Viro Orabug: 33679854 CVE-2021-1048 - fget: check that the fd still exists after getting a ref to it Linus Torvalds Orabug: 33679806 CVE-2021-0920 - fs: add fgetmany and fputmany Jens Axboe Orabug:...

rust-toolset:ol8 security update

rust 1.54.0-3 - Lint against Unicode control codepoints. rust-toolset 1.54.0-1 - Update to Rust and Cargo 1.54.0. 1.53.0-1 - Update to Rust and Cargo 1.53.0...

curl security and bug fix update

7.61.1-22 - fix STARTTLS protocol injection via MITM CVE-2021-22947 - fix protocol downgrade required TLS bypass CVE-2021-22946 7.61.1-21 - fix TELNET stack contents disclosure again CVE-2021-22925 - fix TELNET stack contents disclosure CVE-2021-22898 - fix bad connection reuse due to flawed path...

Unbreakable Enterprise kernel security update

4.1.12-124.57.1 - target; fix print statement warning John Donnelly Orabug: 33495661 - enic;: fix warning on moduleparam disablevlan0, John Donnelly Orabug: 33495661 - bnx2fc: correct BNX2FCTMTIMEOUT to be 60 sec John Donnelly Orabug: 33495661 - target: Fix linux-4.1.y specific compile warning...

unbound security, bug fix, and enhancement update

1.7.3-15 - Fix SPEC file to not check md5 mtime and size of /var/lib/unbound/root.key - Resolves: rhbz1714175 - Use system-wide crypto policy setting PROFILE=SYSTEM instead of custom setting - Resolves: rhbz1842837 - Enable additional logging in unbound - Resolves: rhbz1850460 - security hardenin...

rust-toolset:ol8 security, bug fix, and enhancement update

rust 1.49.0-1 - Update to 1.49.0. 1.48.0-1 - Update to 1.48.0. rust-toolset 1.49.0-1 - Update to Rust and Cargo 1.49.0. 1.48.0-1 - Update to Rust and Cargo 1.48.0...

ghostscript security, bug fix, and enhancement update

9.27-1 - Rebase to 9.27 - Resolves: rhbz1874523...

Unbreakable Enterprise kernel security update

4.14.35-2047.501.2 - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32634994 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE Chris Leech Orabug: 32634994 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi:...

dotnet security and bugfix update

2.1.522-1 - Update to .NET Core SDK 2.1.522 and Runtime 2.1.26 - Resolves: RHBZ1933844...

stunnel security update

5.56-5 - Fix CVE-2021-20230 stunnel: client certificate not correctly verified when redirect and verifyChain options are used...

ImageMagick security update

6.9.10.68-5 - Adding CTV-2020-29599 fix...

thunderbird security update

78.6.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.6.0-1 - Update to 78.6.0...

librepo security update

1.8.1-8 - Validate paths read from repomd.xml RhBug: 1866500...

glibc security, bug fix, and enhancement update

2.28-127.0.1 - add Ampere emag to tunable cpu list Patrick McGehearty - add optimized memset for emag - add an ASIMD variant of strlen for falkor - Orabug: 2700101. - Modify glibc-ora28849085.patch so it works with RHCK kernels. - Orabug: 28849085. - Make IOfunlockfile match funlockfile and...

expat security update

2.2.5-4 - add security fixes for CVE-2018-20843, CVE-2019-15903...

tcpdump security, bug fix, and enhancement update

14:4.9.3-1 - Resolves: 1804063 - Rebase tcpdump to 4.9.3 to fix multiple CVEs...

java-11-openjdk security update

1:11.0.9.11-0.0.1 - link atomic for ix86 build 1:11.0.9.11-0 - Delay tzdata 2020b dependency until tzdata update has shipped. - Resolves: rhbz1876665 1:11.0.9.11-0 - Update to jdk-11.0.9+11 - Update release notes for 11.0.9 release. - Add backport of JDK-8254177 to update to tzdata 2020b - Requir...

firefox security and bug fix update

78.3.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 78.3.0 - Update to 78.3.0 build1 78.2.0-3 - Update to 78.2.0 build1...

qemu-kvm security, bug fix, and enhancement update

1.5.3-175.el7 - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch bz1810408 - Resolves: bz1810408 CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect rhel-7 1.5.3-174.el7 - kvm-util-add-slirpfmt-helpers2.patch bz1800515 - kvm-tcpemu-fix-unsafe-snprintf-usages2.patch bz1800515 -...

nodejs:12 security update

nodejs 12.18.2-1 - Rebase to 12.18.2 1:12.18.1-1 - Rebase - Spec clean up - Provide i18n package, bundle icu - Resolves: RHBZ1845310, RHBZ1845691 1:12.18.0-1 - Security update to 12.18.0 - Resolves: RHBZ1845310, RHBZ1845691 1:12.16.1-2 - Fix CVE-2020-10531 1:12.16.1-1 - Resolves: RHBZ1800395,...

kernel security and bug fix update

3.10.0-1127.13.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 3.10.0-1127.13.1 - x86 x86/speculation: Support old struct x86cpuid & x86matchcpu...

unbound security update

1.6.6-4 - Fix amplifying an incoming query into a large number of queries directed to a target - Resolves: rhbz1839172 CVE-2020-12662, rhbz1840258 CVE-2020-12663...

python27:2.7 security, bug fix, and enhancement update

...

java-1.8.0-openjdk security update

1:1.8.0.212.b04-1 - Remove additions to EXTRACFLAGS and EXTRACPPFLAGS which are now made by upstream. - Resolves: rhbz1693468 1:1.8.0.212.b04-1 - Add JDK-8223219 to avoid -fstack-protector overriding -fstack-protector-strong - Resolves: rhbz1693468 1:1.8.0.212.b04-0 - Update to...

libssh2 security update

1.4.3-12.0.1.el76.2 - Orabug: 29909723 Added patch CVE-2019-3862 added length checks to prevent out-of-bounds reads and writes in libssh2packetaddCVE-2019-3862...

java-1.7.0-openjdk security update

1:1.7.0.211-2.6.17.1.0.1 - Update DISTRONAME in specfile 1:1.7.0.211-2.6.17.1 - Produce debug symbols for libpulse-java.so - Set ITCFLAGS=-g so that debug symbols for the pulse audio - native library are being produced. This is needed to fix - rpmdiff errors of missing .debuginfo in...

nss security update

3.36.0-7 - Backport upstream fix for CVE-2018-12384 - Remove nss-lockcert-api-change.patch, which turned out to be a mistake the symbol was not exported from libnss 3.36.0-6 - Exercise SSL tests which only run under non-FIPS setting...

java-1.7.0-openjdk security update

1:1.7.0.181-2.6.14.8.0.1 - Update DISTRONAME in specfile 1:1.7.0.181-2.6.14.8 - added and applied 1566890embargoed20180521.patch - Resolves: rhbz1578550...

thunderbird security update

52.4.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 52.4.0-2 - Update to 52.4.0 b2...

dnsmasq security update

2.76-2.2 - Small correction of CVE-2017-14491 2.76-2.1 - Fix CVE-2017-14491 - Fix CVE-2017-14492 - Fix CVE-2017-14493 - Fix CVE-2017-14494 - Fix CVE-2017-14496 - Fix CVE-2017-14495 - extra fixes...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-103.3.8.1 - Bluetooth: Properly check L2CAP config option output buffer length Ben Seri Orabug: 26796363 CVE-2017-1000251...

freeradius security update

2.2.6-7 - Resolves: Bug1469115 CVE-2017-10979 freeradius: Out-of-bounds write in radcoalesce - Resolves: Bug1469118 CVE-2017-10978 freeradius: Out-of-bounds read/write due to improper output buffer size check in makesecret - Resolves: Bug1469120 CVE-2017-10980 freeradius: Memory leak in decodetlv...

bind security and bug fix update

32:9.8.2-0.62.rc1.4 - Fix CVE-2017-3142 and CVE-2017-3143 32:9.8.2-0.62.rc1.3 - Update root servers and trust anchors 1458234...

openssl-fips security update

1.0.1t-2.0.1 - update to upstream 1.0.1t - Original 1.0.1 test certificates has expired on May 10, 2016. Updated certificatea were copied from 1.0.2h tree [email protected]...

mariadb security and bug fix update

1:5.5.47-1 - Rebase to 5.5.47 Also fixes: CVE-2015-4792 CVE-2015-4802 CVE-2015-4815 CVE-2015-4816 CVE-2015-4819 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836 CVE-2015-4858 CVE-2015-4861 CVE-2015-4870 CVE-2015-4879 CVE-2015-4913 CVE-2015-7744 CVE-2016-0505 CVE-2016-0546 CVE-2016-0596 CVE-2016-0597...

thunderbird security update

38.7.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 38.7.0-1 - Update to 38.7.0...

nss security update

3.19.1-4 - Actually apply the fix for CVE-2016-1950 from NSS 3.19.2.3 ... 3.19.1-3 - Include the fix for CVE-2016-1950 from NSS 3.19.2.3...

java-1.7.0-openjdk security update

1.7.0.95-2.6.4.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.95-2.6.4.0 - Bump to 2.6.4 and u95b00. - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it. - Drop 8072932or8074489 patch as applied upstream in u91b01. - Add MD5 checksums for last two version of th...

samba4 security update

4.0.0-67.rc4 - resolves: 1290708 - CVE-2015-7540 - related: 1290708 - CVE-2015-5299 - related: 1290708 - CVE-2015-5296 - related: 1290708 - CVE-2015-5252 - related: 1290708 - CVE-2015-5330...

samba security update

4.2.3-11 - resolves: 1290710 - CVE-2015-3223 Remote DoS in Samba AD LDAP server - CVE-2015-5299 Missing access control check in shadow copy code - CVE-2015-5252 Insufficient symlink verification in smbd - CVE-2015-5296 Samba client requesting encryption vulnerable to downgrade attack...

gnutls security update

3.3.8-14 - Prevent downgrade attack to RSA-MD5 in server key exchange. 3.3.8-13 - Corrected reseed and respect of maxnumberofbitsperrequest in FIPS140-2 mode. Also enhanced the initial tests. 1228199...

java-1.8.0-openjdk security update

1:1.8.0.65-0.b17 - October 2015 security update to u65b17. - Add script for generating OpenJDK tarballs from a local Mercurial tree. - Update RH1191652 patch to build against current AArch64 tree. - Use appropriate source ID to avoid unpacking both tarballs on AArch64. - Fix library removal scrip...

openssl security update

0.9.8e-36.0.1 - Backport openssl 08-Jan-2015 security fixes John Haxby orabug 20409893 - fix CVE-2014-3570 - Bignum squaring may produce incorrect results - fix CVE-2014-3571 - DTLS segmentation fault in dtls1getrecord - fix CVE-2014-3572 - ECDHE silently downgrades to ECDH Client 0.9.8e-36 - als...

php security update

5.1.6-45 - core: fix integer overflow in unserialize CVE-2014-3669 - exif: fix heap corruption issue in exifthumbnail CVE-2014-3670 - xmlrpc: fix buffer overflow in date parser 1155607...