4418 matches found
RLSA-2020:5503 Moderate: mariadb-connector-c security, bug fix, and enhancement update
The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. The following packages have been upgraded to a later upstream version: mariadb-connector-c 3.1.11. BZ1898993 Security Fixes: mysql: C API unspecified vulnerability CPU Apr...
RLSA-2020:5500 Important: mariadb:10.3 security, bug fix, and enhancement update
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb 10.3.27, galera 25.3.31. BZ1899082, BZ1899086 Security Fixes: mariadb: Insufficient SST method name check leading to cod...
RLSA-2020:5499 Moderate: nodejs:12 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs-y18n: prototype pollution vulnerability CVE-2020-7774 c-ares: aresparsea,aaaareply insufficient naddrttls validation DoS CVE-2020-8277...
RLSA-2020:5393 Important: libexif security update
The libexif packages provide a library for extracting extra information from image files. Security Fixes: libexif: out of bounds write due to an integer overflow in exif-entry.c CVE-2020-0452 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and othe...
RLSA-2020:4952 Important: freetype security update
FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently. Security Fixes: freetype: Heap-based buffer overflow due to integer truncation in LoadSBitPng CVE-2020-15999 For more details about the...
RLSA-2020:4827 Moderate: oniguruma security update
Oniguruma is a regular expressions library that supports a variety of character encodings. Security Fixes: oniguruma: NULL pointer dereference in matchat in regexec.c CVE-2019-13225 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...
RLSA-2020:4820 Moderate: file-roller security update
File Roller is an application for creating and viewing archives files, such as tar or zip files. Security Fixes: file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive CVE-2019-16680 file-roller: directory traversal via directory symlink pointing...
RLSA-2020:4807 Moderate: prometheus-jmx-exporter security update
Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security Fixes: snakeyaml: Billion laughs attack via alias feature CVE-2017-18640 For more details about the security issues, including the impact, a CVSS score...
RLSA-2020:4799 Moderate: freeradius:3.0 security and bug fix update
FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized authentication and authorization for a network. Security Fixes: freeradius: eap-pwd: DoS issues due to multithreaded BNCTX access CVE-2019-17185 Fo...
RLSA-2020:4760 Moderate: tcpdump security, bug fix, and enhancement update
The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces. The following packages have been upgraded to a later upstream version: tcpdump 4.9.3. BZ1804063...
RLSA-2020:4756 Moderate: varnish:6 security, bug fix, and enhancement update
Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. The following packages have been upgraded to a later upstream version: varnish 6.0.6. BZ1795673...
RLSA-2020:4751 Moderate: httpd:2.4 security, bug fix, and enhancement update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. The following packages have been upgraded to a later upstream version: modhttp2 1.15.7. BZ1814236 Security Fixes: httpd: memory corruption on early pushes CVE-2019-10081 httpd: read-after-free in ...
RLSA-2020:4743 Moderate: squid:4 security, bug fix, and enhancement update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. The following packages have been upgraded to a later upstream version: squid 4.11. BZ1829467 Security Fixes: squid: Improper input validation in request allows for proxy manipulation...
RLSA-2020:4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
The Public Key Infrastructure PKI Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fixes: jquery: Cross-site scripting via cross-domain ajax requests CVE-2015-9251 bootstrap: XSS in the data-target attribute CVE-2016-10735 bootstrap:...
RLSA-2020:4712 Moderate: subversion:1.10 security update
Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Security Fixes: subversion: remotely triggerable DoS vulnerability in svnserve...
RLSA-2020:4709 Moderate: librsvg2 security update
The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Resource exhaustion via crafted SVG file with nested patterns CVE-2019-20446 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...
RLSA-2020:4694 Moderate: container-tools:rhel8 security, bug fix, and enhancement update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters CVE-2020-10749 QEMU: slirp: networking out-of-bounds read information...
RLSA-2020:4690 Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: XML entity expansion vulnerability CVE-2015-9541 qt5-qtwebsockets: websocket implementation allows only limited size for frames and...
RLSA-2020:4689 Moderate: openwsman security update
Openwsman is a project intended to provide an open source implementation of the Web Services Management specification WS-Management and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services...
RLSA-2020:4676 Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting wi...
RLSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
Rocky Enterprise Software Foundation Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. The following packages have been upgraded to a later upstream version: ipa 4.8.7, softhsm...
RLSA-2020:4659 Moderate: gd security update
GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. Security Fixes: gd: Heap-based buffer overflow in gdImageColorMatch in gdcolormatch.c CVE-2019-6977 gd: NULL pointer dereference in...
RLSA-2020:4654 Moderate: python27:2.7 security update
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for...
RLSA-2020:4649 Low: evolution security and bug fix update
Evolution is a GNOME application that provides integrated email, calendar, contact management, and communications functionality. The evolution-data-server packages provide a unified back end for applications which interact with contacts, tasks and calendar information. Evolution Data Server was...
RLSA-2020:4647 Moderate: freerdp and vinagre security, bug fix, and enhancement update
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. The vinagre packages provide the Vinagre remote desktop viewer for the GNOME desktop. Th...
RLSA-2020:4641 Moderate: python38:3.8 security, bug fix, and enhancement update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following...
RLSA-2020:4638 Low: sysstat security update
The sysstat packages provide the sar and iostat commands. These commands enable system monitoring of disk, network, and other I/O activity. Security Fixes: sysstat: memory corruption due to an integer overflow in remapstruct in sacommon.c CVE-2019-16167 For more details about the security issues,...
RLSA-2020:4634 Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: integer overflow leading to heap-based buffer overflow in tifgetimage.c CVE-2019-17546 For more details about the security issues, including the impact, a CVSS score,...
RLSA-2020:4629 Moderate: libvpx security update
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fixes: libvpx: Double free in ParseContentEncodingEntry in mkvparser.cc CVE-2019-2126 libvpx: Out of bounds read in vp8nor...
RLSA-2020:4628 Low: libreoffice security, bug fix, and enhancement update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...
RLSA-2020:4545 Moderate: libssh security, bug fix, and enhancement update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. The following packages have been upgraded to a later upstream version: libssh 0.9.4. BZ1804797 Security Fixes: libssh: denial of service when handling AES-CTR or DES ciphers...
RLSA-2020:4539 Moderate: pcre2 security and enhancement update
The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 For...
RLSA-2020:4497 Moderate: cyrus-sasl security, bug fix, and enhancement update
The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer SASL. SASL is a method for adding authentication support to connection-based protocols. Security Fixes: cyrus-sasl: denial of service in sasladdstring function CVE-2019-19906 For more details abou...
RLSA-2020:4490 Moderate: gnupg2 security, bug fix, and enhancement update
The GNU Privacy Guard GnuPG or GPG is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. The following packages have been upgraded to a later upstream version: gnupg2 2.2.20. BZ1663944 Security Fixes: GnuPG: interaction between the sks-keyserv...
RLSA-2020:4484 Moderate: expat security update
Expat is a C library for parsing XML documents. Security Fixes: expat: large number of colons in input makes parser consume high amount of resources, leading to DoS CVE-2018-20843 expat: heap-based buffer over-read via crafted XML input CVE-2019-15903 For more details about the security issues,...
RLSA-2020:4482 Moderate: libgcrypt security, bug fix, and enhancement update
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. The following packages have been upgraded to a later upstream version: libgcrypt 1.8.5. BZ1764918 Security Fixes: libgcrypt: ECDSA timing attack allowing private key leak CVE-2019-13627 For more...
RLSA-2020:4469 Low: cups security and bug fix update
The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups: heap based buffer overflow in libcups's ppdFindOption in ppd-mark.c CVE-2020-3898 For more details about the security issues, including the impact, a CVSS...
RLSA-2020:4453 Moderate: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode CVE-2019-20807 For more details about the security issues, including the impact, a CVSS score, acknowledgments, an...
RLSA-2020:4451 Moderate: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of Rocky Linux. The following packages have been upgraded to a later upstream version: gnome-remote-desktop 0.1.8, pipewire 0.3.6, vte291 0.52.4, webkit2gtk3 2.28.4, xdg-desktop-portal 1.6.0, xdg-desktop-portal-gtk 1.6.0. BZ1775345, BZ1779691, BZ1817143,...
RLSA-2020:4436 Low: gnome-software and fwupd security, bug fix, and enhancement update
The gnome-software packages contain an application that makes it easy to add, remove, and update software in the GNOME desktop. The appstream-data package provides the distribution specific AppStream metadata required for the GNOME and KDE software centers. The fwupd packages provide a service th...
RLSA-2020:4272 Moderate: nodejs:12 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 12.18.4. Security Fixes: nodejs-dot-prop: prototype pollution CVE-2020-8116 nodejs:...
RLSA-2020:4059 Important: virt:rhel security update
Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting wi...
RLSA-2020:3732 Important: mysql:8.0 security update
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql 8.0.21. Security Fixes: mysql: Server: Security: Privileges multiple...
RLSA-2020:3662 Moderate: php:7.3 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php 7.3.20. BZ1856655 Security Fixes: php: Out-of-bounds read due to integer overflow in iconvmimedecodeheaders CVE-2019-11039 php: Buffer...
RLSA-2020:3654 Moderate: libcroco security update
The libcroco is a standalone Cascading Style Sheet level 2 CSS2 parsing and manipulation library. Security Fixes: libcroco: Stack overflow in function crparserparseanycore in cr-parser.c CVE-2020-12825 For more details about the security issues, including the impact, a CVSS score, acknowledgments...
RLSA-2020:3623 Important: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: HTTP Request Smuggling could result in cache poisoning CVE-2020-15810 squid: HTTP Request Splitting could result in cache poisoning CVE-2020-15811 For more detai...
RLSA-2020:3280 Moderate: nss and nspr security, bug fix, and enhancement update
Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. The following packages have been upgrad...
RLSA-2020:3185 Important: python-pillow security update
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fixes: python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in...
RLSA-2020:3176 Important: postgresql-jdbc security update
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fixes: postgresql-jdbc: XML external entity XXE vulnerability in PgSQLXML CVE-2020-13692 This update...
RLSA-2020:3053 Moderate: container-tools:rhel8 security, bug fix, and enhancement update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: QEMU: slirp: use-after-free in ipreass function in ipinput.c CVE-2020-1983 For more details about the security issues, including the impact, a CVSS score,...