kernel security update

4.18.0-553.84.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

container-tools:rhel8 security update

slirp4netns 1.2.3-1 - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3 - Related: Jira:RHEL-2110 1.2.2-1 - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2 - Related: Jira:RHEL-2110 1.2.1-1 - update to...

idm:DL1 security update

bind-dyndb-ldap 11.6-6 - Fix rpminspect warnings Resolves: RHEL-22497 custodia ipa 4.9.13-20.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 ipa-healthcheck opendnssec 2.1.7-2 - Don't creat /var/run/opendnssec directory - Resolves: RHEL-12163 python-jwcrypto python-kdcproxy...

ipa security update

4.6.8-5.0.5.el79.17 - Fixes CVE-2025-7493 Enforce uniqueness across krbprincipalname - and krbcanonicalname Orabug: 38520120 4.6.8-5.0.3.el79.17 - Fix privilege escalation from host to domain vulnerability - CVE-2025-4404 Orabug: 38085890...

java-1.8.0-openjdk security update

1.8.0.472.b08-1.0.1 - Update to 8u472-b08 GA Orabug: 38571645 - Update release notes for 8u472-b08. - Drop local JDK-8339414 fix as this is now included upstream - Reset rpmrelease to 1 now there are no other RPM builds on RHEL 8 - Sync the copy of the portable specfile with the latest update -...

kernel security update

4.18.0-553.83.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-570.62.1.0.1 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

libtiff security update

4.0.9-36 - fix CVE-2025-8176: prevent skipping first line in tiffdither and tiffmedian tools RHEL-120230...

bind9.18 security update

32:9.18.29-4.2 - Fix upstream reported regression in recent CVE fix CVE-2025-8677 - Add upstream created test to this regression 32:9.18.29-4.1 - Refuse malformed DNSKEY records CVE-2025-8677 - Address various spoofing attacks CVE-2025-40778 - Prevent cache poisoning due to weak PRNG CVE-2025-407...

bind security update

9.16.23-31.0.1 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-31.2 - Replace downstream fixes with upstream changes 32:9.16.23-31.1 - Prevent cache poisoning due to weak PRNG CVE-2025-40780 - Address various spoofing attacks CVE-2025-40778...

Unbreakable Enterprise kernel security update

5.15.0-314.193.5.3 - Revert 'cpufreq: Introduce an optional cpuinfoavgfreq sysfs entry' Samasth Norway Ananda Orabug: 38633525 5.15.0-314.193.5.2 - i40e: add validation for ringlen param Lukasz Czapnik Orabug: 38607608 CVE-2025-39973 - i40e: increase max descriptors for XL710 Justin Bronder Orabu...

Unbreakable Enterprise kernel security update

5.4.17-2136.349.3.1 - i40e: add validation for ringlen param Lukasz Czapnik Orabug: 38604171 CVE-2025-39973 - i40e: increase max descriptors for XL710 Justin Bronder Orabug: 38604171 CVE-2025-39973 5.4.17-2136.349.3 - Revert 'net/mlx5e: Update and set Xon/Xoff upon MTU set' Jakub Kicinski Orabug:...

runc security update

4:1.2.5-3 - Add relevant patches to CVEs - Resolves: RHEL-122402 4:1.2.5-2 - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881 - Resolves: RHEL-122402 - Resolves: RHEL-122404 - Resolves: RHEL-122415 4:1.2.5-1 - update to https://github.com/opencontainers/runc/releases/tag/v1.2.5 - Related: RHEL-60...

mingw-libtiff security update

4.0.9-3 - Fix CVE-2018-5784 CVE-2018-7456 CVE-2017-9935 CVE-2017-9935 - Fix CVE-2017-18013 CVE-2018-8905 CVE-2018-10963 CVE-2018-17100 - Fix CVE-2018-18557 CVE-2018-18661 RHBZ 1602597 CVE-2018-12900 - Fix CVE-2019-14973 CVE-2019-17546 CVE-2020-35521 CVE-2020-35522 - Fix CVE-2020-35523...

tigervnc security update

1.15.0-8 - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation Resolves: RHEL-119979 - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal Resolves: RHEL-120001 - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb...

linux-firmware security update

20251030-999.44.1.gite9292517.el9 - Include AMD ucode fix Orabug: 38523856 CVE-2025-62626...

linux-firmware security update

20251030-999.44.1.gite9292517.el7 - Include AMD ucode fix Orabug: 38523856 CVE-2025-62626...

pcs security update

0.10.18-2.0.1.7 - Replaced HAM-logo...

linux-firmware security update

20251030-999.44.1.gite9292517.el8 - Include AMD ucode fix Orabug: 38523856 CVE-2025-62626...

qt5-qt3d security update

5.15.9-2.1 - Assimp: Fix heap-based overflow in Q3DLoader::InternReadFile Resolves: RHEL-120988...

bind9.16 security update

32:9.16.23-0.22.4 - Prevent cache poisoning due to weak PRNG CVE-2025-40780 - Address various spoofing attacks CVE-2025-40778 - Replace downstream fixes with upstream changes 32:9.16.23-0.22.3 - Update addresses of b.root-servers.net RHEL-18449...

mariadb:10.5 security update

galera 26.4.22-1 - Rebase to 26.4.22 Judy 1.0.5-18 - Remove README.Fedora; no longer needed since 1.0.5 version - Resolves: 1638717 1.0.5-17 - ldconfig scriptlets replaced by RPM File Triggers from Fedora 28 - Drop legacy BuildRoot: and Group: tags - Drop redundant explicit buildroot cleaning -...

galera and mariadb security update

galera 26.4.22-1 - Rebase to 26.4.22 mariadb 3:10.5.29-2 - Release bump for rebuild 3:10.5.29-1 - Rebase to 10.5.29...

bind security update

32:9.11.36-16.6 - Address various spoofing attacks CVE-2025-40778 32:9.11.36-16.5 - Add support for max-records-per-type and max-types-per-name options RHEL-61936 - Support reading of new options also in named-checkconf -z, v2...

osbuild-composer security update

132.2-3.0.1 - Switch to UEKR8 repositories for OL9.6 Orabug: 37962207 - Add support to create OpenScap images JIRA: OLDIS-35301 - Simplify repository names JIRA: OLDIS-35893 - Refactor patches to fix some naming and set a correct kernel for Oracle Linux Orabug: 37253643 - Support using OCI...

libsoup security update

2.72.0-10.3 - Backport patch for CVE-2025-4945 and CVE-2025-11021 2.72.0-10.2 - Backport patches for various CVEs Resolves: RHEL-85888 Resolves: RHEL-87081 Resolves: RHEL-88332 Resolves: RHEL-92285 2.72.0-10.1 - Backport patches for various CVEs, plus test improvements Resolves: RHEL-85906...

sssd security update

2.9.4-5.0.2.3 - Missing ntohs to service port Orabug: 37389651 - Restore default debug level for ssscache Orabug: 32810448 2.9.4-5.3 - Resolves: RHEL-112455 - p11child currently has an infinite timeout rhel-8.10.z - Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration...

xorg-x11-server-Xwayland update

23.2.7-5 - CVE fix for: CVE-2025-62229 RHEL-119975, CVE-2025-62230 RHEL-120020, CVE-2025-62231 RHEL-125016...

xorg-x11-server-Xwayland security update

21.1.3-19 - CVE fix for: CVE-2025-62229 RHEL-119967, CVE-2025-62230 RHEL-120015, CVE-2025-62231 RHEL-125007...

xorg-x11-server security update

1.20.11-27 - CVE fix for: CVE-2025-62229 RHEL-119953, CVE-2025-62230 RHEL-120027, CVE-2025-62231 RHEL-124993...

kernel security update

5.14.0-570.60.1.0.1 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

xorg-x11-server update

1.20.11-32 - CVE fix for: CVE-2025-62229 RHEL-119961, CVE-2025-62230 RHEL-120032, CVE-2025-62231 RHEL-125001...

kernel security update

4.18.0-553.82.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Unbreakable Enterprise kernel security update

5.15.0-313.189.5.3 - i40e: add validation for ringlen param Lukasz Czapnik Orabug: 38603025 CVE-2025-39973 - i40e: increase max descriptors for XL710 Justin Bronder Orabug: 38603025...

tigervnc security update

1.14.1-9 - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation Resolves: RHEL-119987 - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal Resolves: RHEL-120006 - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb...

pcs security update

0.11.9-2.el96.2 - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack Resolves: RHEL-120943, RHEL-121036, RHEL-123631, RHEL-123644, RHEL-124942...

Unbreakable Enterprise kernel security update

5.4.17-2136.348.3.1 - i40e: add validation for ringlen param Lukasz Czapnik Orabug: 38604168 CVE-2025-39973 - i40e: increase max descriptors for XL710 Justin Bronder Orabug: 38604168 CVE-2025-39973...

redis:7 security update

7.2.11-1.0.1 - Build with 64k pages to support redis on UEK on aarch64 7.2.11-1 - rebase to 7.2.11 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819...

redis:6 security update

6.2.20-1.0.1 - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 6.2.20-1 - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819...

redis security update

6.2.20-1 - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819...

libtiff security update

4.0.9-35 - fix CVE-2025-9900: buffer underflow crash in TIFFReadRGBAImageOriented RHEL-112533...

compat-libtiff3 security update

3.9.4-12.0.1 - Fixes CVE-2025-9900 buffer underflow Orabug: 38523840...

kernel security update

5.14.0-570.58.1.0.1 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

libtiff security update

4.4.0-13.2 - fix CVE-2025-8176 off-by-one error skipping first line in tiffdither and tiffmedian - Resolves: RHEL-120243 4.4.0-13.1 - fix CVE-2025-9900 buffer underflow in TIFFReadRGBAImageOriented - Resolves: RHEL-112542...

squid:4 security update

libecap squid 7:4.15-10.9 - Resolves: RHEL-122484 - squid: Squid vulnerable to information disclosure via authentication credential leakage in error handling CVE-2025-62168...

kernel security update

4.18.0-553.81.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

java-1.8.0-openjdk security update

1:1.8.0.472.b08-1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.472.b08-1 - Update to 8u472-b08 GA. - Update release notes for 8u472-b08. - Drop local JDK-8339414 fix as this is now included upstream - Reset rpmrelease to 1 now there are no other RPM builds on RHEL 9 - Sync the copy of...

Unbreakable Enterprise kernel security update

5.15.0-313.189.5.2 - nfsd: handle getclientlocked failure in nfsd4setclientidconfirm Jeff Layton Orabug: 38575798 CVE-2025-38724 - crypto: afalg - Fix incorrect boolean values in afalgctx Eric Biggers Orabug: 38575792 - crypto: afalg - Disallow concurrent writes in afalgsendmsg Herbert Xu Orabug:...

java-17-openjdk security update

1:17.0.17.0.10-1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.17.0.10-1 - Update to jdk-17.0.17+10 GA - Add to .gitignore openjdk-17.0.17+10.tar.xz - Set buildver to 10 - Set rpmrelease to 1, remove 'must start at 2' comment - Set isga to 1 - Update sources to openjdk-17.0.17+10.tar.xz...

thunderbird security update

140.4.0-2.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.4.0 - Add OpenELA debranding 140.4.0-2 - Update to 140.4.0 ESR...