5197 matches found
ALSA-2022:4991 Important: xz security update
XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm LZMA, which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fixes: gzip:...
ALSA-2022:4940 Important: xz security update
XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm LZMA, which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fixes: gzip:...
ALSA-2022:4807 Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream version: postgresql 12.11. Security Fixes: postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox CVE-2022-1552 For more...
ALSA-2022:4805 Important: postgresql:10 security update
PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream version: postgresql 10.21. Security Fixes: postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox CVE-2022-1552 For more...
ALSA-2022:4797 Important: maven:3.6 security update
The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Security Fixes: maven-shared-utils: Command injection via Commandline class CVE-2022-29599 For more details about the security issues, including the impact, a CVSS score, acknowledgments...
ALSA-2022:4798 Important: maven:3.5 security update
The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Security Fixes: maven-shared-utils: Command injection via Commandline class CVE-2022-29599 For more details about the security issues, including the impact, a CVSS score, acknowledgments...
ALSA-2022:4799 Important: rsyslog security update
The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fixes: rsyslog: Heap-based overflow in TCP syslog server CVE-2022-24903 For...
ALSA-2022:4796 Important: nodejs:16 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: npm: npm ci succeeds when package-lock.json doesn't match package.json CVE-2021-43616 For more details about the security issues, including the...
ALSA-2022:4776 Critical: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.9.1 ESR. Security Fixes: Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution CVE-2022-1529 Mozilla:...
ALSA-2022:4769 Critical: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.1. Security Fixes: Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution CVE-2022-1529 Mozilla: Prototype pollution in Top-Level Await implementati...
ALSA-2022:4661 Important: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: sinatra: path traversal possible outside of publicdir when serving static files CVE-2022-29970 For more details about the security issues, including the impact, a CVSS score,...
ALSA-2022:4587 Important: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: sinatra: path traversal possible outside of publicdir when serving static files CVE-2022-29970 For more details about the security issues, including the impact, a CVSS score,...
ALSA-2022:2234 Important: subversion:1.10 security update
Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Security Fixes: subversion: Subversion's moddavsvn is vulnerable to memory corruption...
ALSA-2022:2202 Important: .NET Core 3.1 security, bug fix, and enhancement update
.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET Core that address a security vulnerability are now available. The updated versions are .NET Core SDK 3.1.419 and .NET Core...
ALSA-2022:2201 Important: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...
ALSA-2022:2200 Important: .NET 5.0 security, bug fix, and enhancement update
.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET Core that address a security vulnerability are now available. The updated versions are .NET Core SDK 5.0.214 and .NET Core...
ALSA-2022:2199 Important: .NET 6.0 security, bug fix, and enhancement update
.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET Core that address a security vulnerability are now available. The updated versions are .NET Core SDK 6.0.105 and .NET Core...
ALSA-2022:2143 Important: container-tools:3.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: psgo: Privilege escalation in 'podman top' CVE-2022-1227 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...
ALSA-2022:2110 Low: grub2 security, bug fix, and enhancement update
The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fixes: grub2: Incorrect...
ALSA-2022:2043 Moderate: c-ares security update
The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. Security Fixes: c-ares: Missing input validation of host names may lead to domain hijacking CVE-2021-3672 For more details about the security issues, including the impact, a CVSS score,...
ALSA-2022:2031 Low: libssh security, bug fix, and enhancement update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. The following packages have been upgraded to a later upstream version: libssh 0.9.6. BZ1896651 Security Fixes: libssh: possible heap-based buffer overflow when rekeying CVE-2021-3634...
ALSA-2022:1988 Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fget: check that the fd still exists after getting a ref to it CVE-2021-4083 kernel: avoid cyclic entity chains due to malformed USB descriptors CVE-2020-0404 kernel: speculation on...
ALSA-2022:1986 Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
ALSA-2022:1968 Moderate: libsndfile security update
libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fixes: libsndfile: heap out-of-bounds read in src/flac.c in flacbuffercopy CVE-2021-4156 For more details about the security issues, including the impact, a CVSS score,...
ALSA-2022:1961 Moderate: cairo and pixman security and bug fix update
Cairo is a 2D graphics library designed to provide high-quality display and print output. Pixman is a pixel manipulation library for the X Window System and Cairo. Security Fixes: cairo: libreoffice slideshow aborts with stack smashing in cairo's compositeboxes CVE-2020-35492 For more details abo...
ALSA-2022:1950 Moderate: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. The following packages...
ALSA-2022:1934 Moderate: mod_auth_mellon security update
The modauthmellon module for the Apache HTTP Server is an authentication service that implements the SAML 2.0 federation protocol. The module grants access based on the attributes received in assertions generated by an IdP server. Security Fixes: modauthmellon: Open Redirect vulnerability in logo...
ALSA-2022:1932 Moderate: python-lxml security update
lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API. Security Fixes: python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through CVE-2021-43818 For more details about the security issues, including the impact, ...
ALSA-2022:1915 Moderate: httpd:2.4 security and bug fix update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Request splitting via HTTP/2 method injection and modproxy CVE-2021-33193 httpd: modproxyuwsgi: out-of-bounds read via a crafted request uri-path CVE-2021-36160 httpd:...
ALSA-2022:1894 Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update
Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. The following packages have been upgraded to a later upstream version: rust 1.58.0. BZ2002883 Security Fixes: rust: Race condition in removedirall leading to...
ALSA-2022:1861 Moderate: maven:3.5 security update
Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: apache-httpclient: incorrect handling of malformed authority...
ALSA-2022:1860 Moderate: maven:3.6 security and enhancement update
Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: apache-httpclient: incorrect handling of malformed authority...
ALSA-2022:1851 Moderate: pki-core:10.6 security and bug fix update
The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: JSS: memory leak in TLS connection leads to OOM CVE-2021-4213 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...
ALSA-2022:1830 Moderate: postgresql:10 security update
PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream version: postgresql 10.19. BZ2023231 Security Fixes: postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 For more details abo...
ALSA-2022:1821 Moderate: python27:2.7 security update
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for...
ALSA-2022:1820 Low: udisks2 security and bug fix update
The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fixes: udisks2: insecure defaults in user-accessible mount helpers allow for a DoS CVE-2021-3802 For more details about the security issues, including the impact,...
ALSA-2022:1810 Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: a buffer overflow via the "invertImage" may lead to DoS CVE-2020-19131 For more details about the security issues, including the impact, a CVSS score, acknowledgments...
ALSA-2022:1808 Moderate: aspell security update
GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fixes: aspell: Heap-buffer-overflow in acommon::ObjStack::duptop CVE-2019-25051 For more details about the security issues, including the impact, a...
ALSA-2022:1797 Moderate: compat-exiv2-026 security update
Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats. Security Fixes: exiv2: stack exhaustion issue...
ALSA-2022:1796 Moderate: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke CVE-2021-38593 For mor...
ALSA-2022:1793 Moderate: container-tools:3.0 security and bug fix update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: crun: Default inheritable capabilities for linux container should be empty CVE-2022-27650 For more details about the security issues, including the impact, a CVSS scor...
ALSA-2022:1792 Moderate: flatpak security and bug fix update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Permissions granted to applications can be hidden from the user at install time CVE-2021-43860 For more details about the security issues, including the impact, a CVSS...
ALSA-2022:1766 Moderate: libreoffice security, bug fix, and enhancement update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...
ALSA-2022:1763 Moderate: python39:3.9 and python39-devel:3.9 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
ALSA-2022:1759 Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...
ALSA-2022:2129 Moderate: lynx security update
Lynx is a text-based Web browser. Lynx does not display any images, but it does support frames, tables, and most other HTML tags. Security Fixes: lynx: Disclosure of HTTP authentication credentials via SNI data CVE-2021-38165 For more details about the security issues, including the impact, a CVS...
ALSA-2022:2120 Moderate: zsh security update
The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the Korn shell, but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell...
ALSA-2022:2092 Moderate: bind security, bug fix, and enhancement update
The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. The following...
ALSA-2022:2081 Low: bluez security update
The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts AlmaLinux, and pcmcia configuration files. Security Fixes: bluez: memory leak in the SDP protocol CVE-2021-41229 For more details about the securi...
ALSA-2022:2013 Moderate: openssh security, bug fix, and enhancement update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are...